Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-12045— pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

Quick assessment

Affected
pgadmin.org pgAdmin 4
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pgadmin 4是pgAdmin组织开源的一款数据库管理工具。 pgAdmin 4 9.13版本至9.16之前版本存在安全漏洞，该漏洞源于AI Assistant的execute_sql_query工具未正确限制LLM生成的SQL语句，允许攻击者通过提示注入绕过只读事务，执行任意SQL命令，导致未授权数据修改，当pgAdmin用户的角色为超级用户或拥有pg_execute_server_program权限时，还可能通过COPY TO PROGRAM实现远程代码执行。

CVSS 9.0 · Critical EPSS 0.66% · P50

Affected Version Matrix 1

VendorProduct Version RangeStatus
pgadmin.org pgAdmin 4 9.13< 9.16 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-12045

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution
Source: CVE Program / CVE List V5
Vulnerability Description
Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect. Delivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user's role the attacker can perform unauthorised data modification. When the pgAdmin user's role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM. Fix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, CALL, COPY, DO, SET/RESET, and everything else are rejected before any database work happens. PostgreSQL's READ ONLY mode continues to backstop data-modifying CTEs, EXPLAIN ANALYZE on writes, and volatile side effects. This issue affects pgAdmin 4: from 9.13 before 9.16.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
pgAdmin 4 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pgadmin 4是pgAdmin组织开源的一款数据库管理工具。 pgAdmin 4 9.13版本至9.16之前版本存在安全漏洞，该漏洞源于AI Assistant的execute_sql_query工具未正确限制LLM生成的SQL语句，允许攻击者通过提示注入绕过只读事务，执行任意SQL命令，导致未授权数据修改，当pgAdmin用户的角色为超级用户或拥有pg_execute_server_program权限时，还可能通过COPY TO PROGRAM实现远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
pgadmin.org pgAdmin 4 9.13 ~ 9.16 -

II. Public POCs for CVE-2026-12045

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Reproduced successfully in a real sandbox · Below is the actual recording of building the environment and exploiting the vulnerability.
Success marker: VULNERABLE: exploit did not retrieve proof token
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
Qwen3.6-35B-A3B · 10973 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-12045

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-12045 (1)

Vendor Advisories for CVE-2026-12045 (1)

Same Patch Batch · pgadmin.org · 2026-06-18 · 7 CVEs total

CVE-2026-12048 9.3 CRITICAL pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-p
CVE-2026-12046 9.0 CRITICAL pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection
CVE-2026-12044 8.8 HIGH pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog temp
CVE-2026-12049 4.3 MEDIUM pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parame
CVE-2026-12050 4.3 MEDIUM pgAdmin 4: SQL injection in named restore point endpoint
CVE-2026-12047 3.5 LOW pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised S

IV. Related Vulnerabilities

Same product: pgAdmin 4
Same vendor: pgadmin.org
Same weakness: CWE-89

V. Comments for CVE-2026-12045

No comments yet

Leave a comment