Read the docs
TI-2026-10387 Aliases CVE-2026-12050GHSA-v395-x24j-4r3g

pgAdmin 4: SQL injection in named restore point endpoint

Priority LOW 24CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint. The injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate. Fix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string. This issue affects pgAdmin 4: from 1.0 before 9.16.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Fix Fixed pgAdmin 4 (pgadmin.org): 9.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pgadmin.orgpgAdmin 41.0 to before 9.169.16Patch availableCNA
  • pgAdmin 4 Vendorpgadmin.org Affected 1.0 to before 9.16 Fixed in 9.16 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*1.0 to before 9.16Vulnerablepgadmin.org
  • cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* Versions 1.0 to before 9.16 Vulnerable ·pgadmin.org

Remediation

  • Fix · CNA pgAdmin 4 (pgadmin.org) Fixed in 9.16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    pgadmin.org pgAdmin 4 9.16

    7 records Highest priority Priority MEDIUM 4 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-10383 Missing authentication in pgadmin.org pgAdmin 4Priority MEDIUM 45
    • TI-2026-10382 pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code executionPriority MEDIUM 43
    • TI-2026-10385 pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parserPriority MEDIUM 42
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12050
  2. 2026-10-03 Alias added: GHSA-v395-x24j-4r3g

References

Patch 2

  • TI-2024-01901 Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 CVSS 3.1CRITICAL 9.9
  • TI-2024-02918 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 CVSS 3.1CRITICAL 9.8
  • TI-2022-03867 Code injection in pgadmin4 CVSS 3.1HIGH 8.8
  • TI-2026-06875 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode CVSS 4.0CRITICAL 9.4
  • TI-2025-02572 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment CVSS 3.1CRITICAL 9.9
  • TI-2023-00228 Path traversal in pgadmin CVSS 3.1MEDIUM 6.5
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences