Three Critical pgAdmin 4 Vulnerabilities Patched: XSS, Auth Bypass, and AI Assistant SQLi

Database administrators have urgent patching to do. The pgAdmin team has fixed three critical pgAdmin 4 vulnerabilities, all rated above CVSS 9.0. Together, they expose the popular PostgreSQL management tool to cross-site scripting, code execution, and SQL abuse. Notably, version 9.16 closes every one of them.

Why It Matters

pgAdmin is the go-to graphical tool for PostgreSQL worldwide. So these flaws reach a huge base of developers and admins. Many teams run it in shared, server-mode deployments. That setup widens the potential blast radius considerably.

Stored XSS Inside the Interface

The first flaw is CVE-2026-12048, a stored XSS bug scoring CVSS 9.3. It lives in how pgAdmin renders error messages and Explain plan nodes. Essentially, text returned by a PostgreSQL server passed through unsanitized. Even a low-privilege user who creates a cleverly named table could plant the payload. Therefore, a malicious server could inject HTML, including an iframe, straight into the pgAdmin DOM.

That makes the attack especially sneaky. Because the injection starts inside pgAdmin itself, frame-blocking headers offer no defense. As a result, a phishing page can look identical to a genuine pgAdmin dialog. The fix wraps DOMPurify around the vulnerable rendering paths.

A Missing Lock on Two Endpoints

Next comes CVE-2026-12046, the highest-rated of the trio at CVSS 9.5. Two SQL Editor endpoints were missing the login-required decorator. Consequently, in server mode they could be reached without authentication. The issue pairs a missing-authentication flaw (CWE-306) with insecure deserialization (CWE-502).

However, full remote code execution is not automatic. An attacker also needs pgAdmin‘s secret key and write access to its session directory. In other words, this flaw is the final hop after a separate compromise. A one-line decorator on each endpoint now blocks unauthenticated requests.

When the AI Assistant Breaks Its Own Rules

The third bug, CVE-2026-12045, targets pgAdmin’s AI Assistant and scores CVSS 9.4. The assistant runs generated SQL inside a read-only transaction for safety. Yet a crafted multi-statement payload could close that transaction early. Then later statements ran in autocommit mode.

Delivery happens through prompt injection. So an attacker who plants text in a database object can steer the assistant. With write privileges, they could modify data. With superuser rights, the chain reaches command execution through COPY TO PROGRAM. This makes it a textbook prompt-injection risk for AI-enabled database tools. The patch now allows only single, read-only statements.

Patch Without Delay

Release 9.16 resolves all three pgAdmin 4 vulnerabilities. Given the severity scores, administrators should upgrade quickly. There is no evidence of active exploitation yet, but the fixes are now public. You can grab the latest build from the official pgAdmin download page. Above all, treat database servers and AI-assistant inputs as untrusted.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.