Skip to content
OpenAdvisories
High WID-SEC-2026-2005 7 CVEs

pgAdmin: Mehrere Schwachstellen

Published Jun 18, 2026 · Updated Aug 16, 2026 · Revision 2 · de-DE

Vendor: SUSE Product: openSUSE Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Code mit Benutzer- oder Administratorrechten auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.

Product

pgAdmin ist eine Verwaltungs- und Entwicklungsplattform für die PostgreSQL-Datenbank.

Vulnerabilities 7

  • Critical 9.3
    CVE-2026-12048

    pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser

    Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / …

    pgadmin.org pgAdmin 4
  • Critical 9.0
    CVE-2026-12045

    pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

    Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's execute_sql_query to…

    pgadmin.org pgAdmin 4
  • Critical 9.0
    CVE-2026-12046

    pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution

    Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> -- were the only routes in the module missing the @pga_login_required decorato…

    pgadmin.org pgAdmin 4
  • High 8.8
    CVE-2026-12044

    pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

    SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<description>'`` for a user-supplied description field. The Jinja templates for Domains (and their constraints), Foreign Tables, Languages, and Event Triggers, plus the …

    pgadmin.org pgAdmin 4
  • Medium 4.3
    CVE-2026-12049

    pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter

    Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honoured the user-supplied 'next' query/form parameter without confirming the target pointed back inside pgAdmin, so an authenticated victim who clicked /mf…

    pgadmin.org pgAdmin 4
  • Medium 4.3
    CVE-2026-12050

    pgAdmin 4: SQL injection in named restore point endpoint

    SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing …

    pgadmin.org pgAdmin 4
  • Low 3.5
    CVE-2026-12047

    pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text

    HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and update-server endpoints under /rds/, /azure/, /google/, and the top-level /cloud/ blueprint propagated AWS / Azure / Google SDK exception text — and the relate…

    pgadmin.org pgAdmin 4

Revision history

  1. #2

    Neue Updates von openSUSE aufgenommen

  2. #1

    Initiale Fassung

References