CVE-2026-12045: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in pgadmin.org pgAdmin 4
Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect. Delivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user's role the attacker can perform unauthorised data modification. When the pgAdmin user's role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM. Fix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, CALL, COPY, DO, SET/RESET, and everything else are rejected before any database work happens. PostgreSQL's READ ONLY mode continues to backstop data-modifying CTEs, EXPLAIN ANALYZE on writes, and volatile side effects. This issue affects pgAdmin 4: from 9.13 before 9.16.
AI Analysis
Technical Summary
The vulnerability in pgAdmin 4's AI Assistant execute_sql_query tool allows SQL injection via prompt injection. The AI Assistant wraps LLM-generated SQL queries in a BEGIN TRANSACTION READ ONLY block to prevent data modification. However, it fails to restrict multi-statement queries, allowing an attacker who can inject content into database objects read by the assistant to craft a payload that ends the read-only transaction early and executes subsequent statements with the pgAdmin user's privileges. This can result in unauthorized data changes or, if the user has superuser or pg_execute_server_program privileges, remote code execution via COPY ... TO PROGRAM. The fix enforces upfront validation of the query to ensure it is a single statement starting with safe verbs (SELECT, WITH, EXPLAIN, SHOW, VALUES, TABLE), rejecting transaction control, DML, DDL, and other potentially dangerous commands before any database execution.
Potential Impact
An attacker with the ability to influence database content inspected by the pgAdmin AI Assistant can execute arbitrary SQL commands with the privileges of the pgAdmin user's database role. This can lead to unauthorized data modification. If the pgAdmin user's role is a PostgreSQL superuser or has pg_execute_server_program privileges, the attacker can escalate to remote code execution on the database server host. The vulnerability compromises confidentiality, integrity, and availability of the database and potentially the host system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves validating the LLM-supplied SQL query to ensure it is a single, safe statement before execution. Until an official patch or update is applied, restrict write access to database objects that the AI Assistant may inspect and limit the privileges of the pgAdmin user role to minimize risk.
CVE-2026-12045: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in pgadmin.org pgAdmin 4
Description
Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect. Delivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user's role the attacker can perform unauthorised data modification. When the pgAdmin user's role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM. Fix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, CALL, COPY, DO, SET/RESET, and everything else are rejected before any database work happens. PostgreSQL's READ ONLY mode continues to backstop data-modifying CTEs, EXPLAIN ANALYZE on writes, and volatile side effects. This issue affects pgAdmin 4: from 9.13 before 9.16.
CVSS v3.1
Score 9.0critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in pgAdmin 4's AI Assistant execute_sql_query tool allows SQL injection via prompt injection. The AI Assistant wraps LLM-generated SQL queries in a BEGIN TRANSACTION READ ONLY block to prevent data modification. However, it fails to restrict multi-statement queries, allowing an attacker who can inject content into database objects read by the assistant to craft a payload that ends the read-only transaction early and executes subsequent statements with the pgAdmin user's privileges. This can result in unauthorized data changes or, if the user has superuser or pg_execute_server_program privileges, remote code execution via COPY ... TO PROGRAM. The fix enforces upfront validation of the query to ensure it is a single statement starting with safe verbs (SELECT, WITH, EXPLAIN, SHOW, VALUES, TABLE), rejecting transaction control, DML, DDL, and other potentially dangerous commands before any database execution.
Potential Impact
An attacker with the ability to influence database content inspected by the pgAdmin AI Assistant can execute arbitrary SQL commands with the privileges of the pgAdmin user's database role. This can lead to unauthorized data modification. If the pgAdmin user's role is a PostgreSQL superuser or has pg_execute_server_program privileges, the attacker can escalate to remote code execution on the database server host. The vulnerability compromises confidentiality, integrity, and availability of the database and potentially the host system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves validating the LLM-supplied SQL query to ensure it is a single, safe statement before execution. Until an official patch or update is applied, restrict write access to database objects that the AI Assistant may inspect and limit the privileges of the pgAdmin user role to minimize risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-06-11T20:40:06.461Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a357432f198dc38c1bc0d31
Added to database: 06/19/2026, 16:54:10 UTC
Last enriched: 06/26/2026, 19:13:55 UTC
Last updated: 08/03/2026, 07:17:55 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.