pgAdmin 4 v9.16 Patches 7 Vulnerabilities (CVE-2026-12044 to CVE-2026-12050): SQLi, AI-Assistant Read-Only Bypass to RCE, Auth Bypass with Pickle Deserialization, Stored XSS — Threadlinqs Intelligence
As of 2026-06-22, pgAdmin 4 v9.16 Patches 7 Vulnerabilities (CVE-2026-12044 to CVE-2026-12050): SQLi, AI-Assistant Read-Only Bypass to RCE, Auth Bypass with Pickle Deserialization, Stored XSS is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0900 · Severity: HIGH · CVSS: 9 · Status: PATCHED · Category: VULNERABILITY
pgAdmin 4 v9.16 fixes seven vulnerabilities (CVE-2026-12044 through CVE-2026-12050) in the widely deployed PostgreSQL administration tool. The most severe is an AI Assistant read-only transaction
On June 18-19, 2026 the pgAdmin Development Team (under the PostgreSQL Global Development Group) released pgAdmin 4 v9.16, bundling 64 bug fixes with patches for seven security vulnerabilities tracked as CVE-2026-12044 through CVE-2026-12050. pgAdmin 4 is the most popular open-source administration and development platform for PostgreSQL, deployed both as a desktop application and in multi-user 'server mode' web deployments inside enterprises and cloud environments, which broadens the attack surface for several of these issues.
CVE-2026-12044 (SQL injection, CVSS ~8.8 HIGH) affected sixteen dialog templates that rendered COMMENT ON ... IS '<description>' statements. Object names or descriptions containing apostrophes or crafted input broke out of the string literal, allowing injection. The fix migrates the affected templates to qtLiteral() for safe quoting and rewrites statistics calls to pass the relation OID via a ::oid::regclass cast instead of interpolating identifiers.
CVE-2026-12045 (AI Assistant read-only transaction bypass to RCE, CVSS ~9.0 CRITICAL) is the highest-impact issue. The AI Assistant feature wrapped generated queries in a READ ONLY transaction as a guardrail, but prompt-injected multi-statement payloads could commit outside that wrapper and execute arbitrary SQL. On a connection running with superuser privileges this chains to operating-system command execution through PostgreSQL's COPY ... TO PROGRAM functionality. Because the assistant can be steered by content it reads from the database, an attacker who can influence database content (rows, object comments, error text) can manipulate the assistant into executing write/exec operations the operator never intended.
CVE-2026-12046 (authentication bypass / unsafe deserialization) is an access-control failure in server mode: two SQL Editor endpoints were missing the @pga_login_required decorator, leaving a pickle deserialization sink reachable without authentication. Unauthenticated access to a Python pickle deserialization path is a classic remote-code-execution risk. The fix enforces login validation on all affected endpoints.
CVE-2026-12047 (HTML injection) occurs in the cloud-deployment modules (Amazon RDS, Microsoft Azure, Google Cloud) where SDK exception text was rendered unsanitized through html-react-parser, allowing markup injection into the browser DOM.
CVE-2026-12048 (critical stored XSS) is the broadest client-side issue: PostgreSQL server error text and EXPLAIN plan-node content were passed unsanitized through html-react-parser across notifier toasts, form errors, modal alerts, and the Explain visualizer. A malicious server, or attacker-controlled query plan/error text, could execute script in the pgAdmin operator's session, exfiltrate saved server credentials, and issue SQL against any connected server.
CVE-2026-12049 (open redirect) is an unvalidated 'next' parameter in the multi-factor authentication flow that can redirect a user to an attacker-chosen URL, useful for phishing and credential-harvesting pretexts.
CVE-2026-12050 (SQL injection) is in the named restore point endpoint, where the user-supplied restore point name was interpolated into SQL via str.format() instead of bound parameters; the fix uses parameterized queries.
There is no public reporting of in-the-wild exploitation at disclosure, and no published proof-of-concept exploit; the mechanics are documented in the vendor release notes and security press. The dominant risk profile is privileged-but-authenticated misuse (AI Assistant, SQLi, restore point), malicious-server / hostile-content attacks (stored XSS, HTML injection), and an unauthenticated server-mode deserialization sink (CVE-2026-12046). Enterprises running shared server-mode pgAdmin should treat CVE-2026-12045 and CVE-2026-12046 as priority and upgrade to v9.16 immediately.
Weaknesses (CWE)
CWE-89, CWE-79, CWE-80, CWE-502, CWE-306, CWE-601, CWE-78, CWE-863, CWE-1427, CWE-94
Target sectors: technology, financial, government, healthcare, enterprise IT / database administration
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-12044, CVE-2026-12045, CVE-2026-12046, CVE-2026-12047, CVE-2026-12048, CVE-2026-12049, CVE-2026-12050, T1190, T1566, T1059, T1059.004, T1059.007, T1204.001, T1068, T1078, T1548, T1211