CVE-2026-12046: CWE-306 Missing Authentication for Critical Function in pgadmin.org pgAdmin 4
Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session['gridData'][<trans_id>]['command_obj']: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session. The defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin's Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin's sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin. Fix is a one-line @pga_login_required decorator on each of the two endpoints, matching the convention used by every other route in the module. The is_authenticated / MFA chain now runs before the trans_id is dereferenced, so an unauthenticated request is rejected before reaching the deserialization path. The defect is server-mode only. In DESKTOP mode pgAdmin's before_request hook re-authenticates DESKTOP_USER on every request, so no endpoint can be exercised in an unauthenticated state and no auth decorator (or its absence) is meaningful. The accompanying regression test mirrors the attacker's path -- harvests an X-pgA-CSRFToken from GET /login and replays it against both endpoints -- and self-skips outside server mode for that reason; it is wired into the existing server-mode CI workflow alongside the data-isolation tests. This issue affects pgAdmin 4: from 6.9 before 9.16.
AI Analysis
Technical Summary
This vulnerability involves missing authentication on two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint: DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did>. Both endpoints deserialize data from session['gridData'][<trans_id>]['command_obj'] using pickle.loads without requiring authentication. Exploiting this requires an attacker to have the Flask SECRET_KEY and write access to the session files to craft a malicious pickle payload. The vulnerability exists only in server mode; desktop mode enforces authentication on every request. The fix is a one-line addition of the @pga_login_required decorator to these endpoints, ensuring authentication before deserialization occurs.
Potential Impact
If an attacker can meet the preconditions—knowledge of the Flask SECRET_KEY and write access to pgAdmin's session files—they can exploit the missing authentication to execute arbitrary code remotely within the pgAdmin process context. This leads to full compromise of the host under the pgAdmin service account. However, these preconditions are not granted by the vulnerability itself and require separate security failures. The vulnerability enables unauthenticated remote code execution only as a final step in an existing partial compromise.
Mitigation Recommendations
No official patch or fix link is provided in the data. The described fix is the addition of the @pga_login_required decorator to the two affected endpoints, which enforces authentication before deserialization. Users should verify that their pgAdmin 4 deployment is updated to version 9.16 or later, where this fix is included. Until then, restrict access to the sessions directory and protect the Flask SECRET_KEY to prevent exploitation. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.
CVE-2026-12046: CWE-306 Missing Authentication for Critical Function in pgadmin.org pgAdmin 4
Description
Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session['gridData'][<trans_id>]['command_obj']: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session. The defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin's Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin's sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin. Fix is a one-line @pga_login_required decorator on each of the two endpoints, matching the convention used by every other route in the module. The is_authenticated / MFA chain now runs before the trans_id is dereferenced, so an unauthenticated request is rejected before reaching the deserialization path. The defect is server-mode only. In DESKTOP mode pgAdmin's before_request hook re-authenticates DESKTOP_USER on every request, so no endpoint can be exercised in an unauthenticated state and no auth decorator (or its absence) is meaningful. The accompanying regression test mirrors the attacker's path -- harvests an X-pgA-CSRFToken from GET /login and replays it against both endpoints -- and self-skips outside server mode for that reason; it is wired into the existing server-mode CI workflow alongside the data-isolation tests. This issue affects pgAdmin 4: from 6.9 before 9.16.
CVSS v3.1
Score 9.0critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves missing authentication on two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint: DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did>. Both endpoints deserialize data from session['gridData'][<trans_id>]['command_obj'] using pickle.loads without requiring authentication. Exploiting this requires an attacker to have the Flask SECRET_KEY and write access to the session files to craft a malicious pickle payload. The vulnerability exists only in server mode; desktop mode enforces authentication on every request. The fix is a one-line addition of the @pga_login_required decorator to these endpoints, ensuring authentication before deserialization occurs.
Potential Impact
If an attacker can meet the preconditions—knowledge of the Flask SECRET_KEY and write access to pgAdmin's session files—they can exploit the missing authentication to execute arbitrary code remotely within the pgAdmin process context. This leads to full compromise of the host under the pgAdmin service account. However, these preconditions are not granted by the vulnerability itself and require separate security failures. The vulnerability enables unauthenticated remote code execution only as a final step in an existing partial compromise.
Mitigation Recommendations
No official patch or fix link is provided in the data. The described fix is the addition of the @pga_login_required decorator to the two affected endpoints, which enforces authentication before deserialization. Users should verify that their pgAdmin 4 deployment is updated to version 9.16 or later, where this fix is included. Until then, restrict access to the sessions directory and protect the Flask SECRET_KEY to prevent exploitation. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-06-11T20:40:07.093Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a357432f198dc38c1bc0d35
Added to database: 06/19/2026, 16:54:10 UTC
Last enriched: 06/26/2026, 19:14:03 UTC
Last updated: 08/03/2026, 19:17:58 UTC
Views: 368
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.