Description
SQL injection vulnerability in pgAdmin 4 Maintenance Tool.
Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.
Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.
This issue affects pgAdmin 4: before 9.15.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pgadmin.org | pgAdmin 4 | 7.6 – < 9.15 | 9.15 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pgadmin4 | 9.17-1.1 | openSUSE-SU-2026:11508-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pgadmin4 | < 9.15 | 9.15 | GHSA-hp84-p2gq-6fvr |
Advisories 2
- WID-SEC-2026-1462 pgAdmin: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 16, 2026
- openSUSE-SU-2026:11508-1 pgadmin4-9.17-1.1 on GA media SUSE / openSUSE Security Updates · Aug 14, 2026
References
- https://github.com/pgadmin-org/pgadmin4/issues/9898 issue-tracking