# pgAdmin 4 v9.16 Patches 7 Vulnerabilities (CVE-2026-12044 to CVE-2026-12050): SQLi, AI-Assistant Read-Only Bypass to RCE, Auth Bypass with Pickle Deserialization, Stored XSS

> pgAdmin 4 v9.16 fixes seven vulnerabilities (CVE-2026-12044 through CVE-2026-12050) in the widely deployed PostgreSQL administration tool. The most severe is an AI Assistant read-only transaction bypass (CVE-2026-12045) that lets prompt-injected multi-statement SQL escape the READ ONLY wrapper and chain to OS command execution via COPY ... TO PROGRAM on a superuser connection. The release also addresses SQL injection across sixteen dialog templates, an authentication bypass exposing a pickle deserialization sink, a critical stored XSS that can exfiltrate saved server credentials, HTML injection, an MFA open redirect, and a second SQLi in the named restore point endpoint.

- **Published:** 2026-06-22T00:00:00Z
- **Last reviewed:** 2026-06-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0900
- **ID:** TL-2026-0900
- **Severity:** HIGH (CVSS 9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-12044, CVE-2026-12045, CVE-2026-12046, CVE-2026-12047, CVE-2026-12048, CVE-2026-12049, CVE-2026-12050

## Description

On June 18-19, 2026 the pgAdmin Development Team (under the PostgreSQL Global Development Group) released pgAdmin 4 v9.16, bundling 64 bug fixes with patches for seven security vulnerabilities tracked as CVE-2026-12044 through CVE-2026-12050. pgAdmin 4 is the most popular open-source administration and development platform for PostgreSQL, deployed both as a desktop application and in multi-user 'server mode' web deployments inside enterprises and cloud environments, which broadens the attack surface for several of these issues.

CVE-2026-12044 (SQL injection, CVSS ~8.8 HIGH) affected sixteen dialog templates that rendered COMMENT ON ... IS '<description>' statements. Object names or descriptions containing apostrophes or crafted input broke out of the string literal, allowing injection. The fix migrates the affected templates to qtLiteral() for safe quoting and rewrites statistics calls to pass the relation OID via a ::oid::regclass cast instead of interpolating identifiers.

CVE-2026-12045 (AI Assistant read-only transaction bypass to RCE, CVSS ~9.0 CRITICAL) is the highest-impact issue. The AI Assistant feature wrapped generated queries in a READ ONLY transaction as a guardrail, but prompt-injected multi-statement payloads could commit outside that wrapper and execute arbitrary SQL. On a connection running with superuser privileges this chains to operating-system command execution through PostgreSQL's COPY ... TO PROGRAM functionality. Because the assistant can be steered by content it reads from the database, an attacker who can influence database content (rows, object comments, error text) can manipulate the assistant into executing write/exec operations the operator never intended.

CVE-2026-12046 (authentication bypass / unsafe deserialization) is an access-control failure in server mode: two SQL Editor endpoints were missing the @pga_login_required decorator, leaving a pickle deserialization sink reachable without authentication. Unauthenticated access to a Python pickle deserialization path is a classic remote-code-execution risk. The fix enforces login validation on all affected endpoints.

CVE-2026-12047 (HTML injection) occurs in the cloud-deployment modules (Amazon RDS, Microsoft Azure, Google Cloud) where SDK exception text was rendered unsanitized through html-react-parser, allowing markup injection into the browser DOM.

CVE-2026-12048 (critical stored XSS) is the broadest client-side issue: PostgreSQL server error text and EXPLAIN plan-node content were passed unsanitized through html-react-parser across notifier toasts, form errors, modal alerts, and the Explain visualizer. A malicious server, or attacker-controlled query plan/error text, could execute script in the pgAdmin operator's session, exfiltrate saved server credentials, and issue SQL against any connected server.

CVE-2026-12049 (open redirect) is an unvalidated 'next' parameter in the multi-factor authentication flow that can redirect a user to an attacker-chosen URL, useful for phishing and credential-harvesting pretexts.

CVE-2026-12050 (SQL injection) is in the named restore point endpoint, where the user-supplied restore point name was interpolated into SQL via str.format() instead of bound parameters; the fix uses parameterized queries.

There is no public reporting of in-the-wild exploitation at disclosure, and no published proof-of-concept exploit; the mechanics are documented in the vendor release notes and security press. The dominant risk profile is privileged-but-authenticated misuse (AI Assistant, SQLi, restore point), malicious-server / hostile-content attacks (stored XSS, HTML injection), and an unauthenticated server-mode deserialization sink (CVE-2026-12046). Enterprises running shared server-mode pgAdmin should treat CVE-2026-12045 and CVE-2026-12046 as priority and upgrade to v9.16 immediately.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1059.007 JavaScript
- T1204.001 Malicious Link
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1212 Exploitation for Credential Access
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1213 Data from Information Repositories
- T1185 Browser Session Hijacking
- T1567 Exfiltration Over Web Service
- T1102 Web Service
- T1565.001 Stored Data Manipulation

## Sources

- [pgAdmin 4 v9.16 Released (official PostgreSQL news)](https://www.postgresql.org/about/news/pgadmin-4-v916-released-3324/)
- [pgAdmin 4 v9.16 Release Notes](https://www.pgadmin.org/docs/pgadmin4/latest/release_notes_9_16.html)
- [pgAdmin 4 Released With Fix for 7 Vulnerabilities](https://cybersecuritynews.com/pgadmin-4-released/)
- [New pgAdmin 4 Version Patches Seven Security Flaws and Adds Features](https://cyberpress.org/pgadmin-4-version-patched/)
- [pgAdmin 4 vulnerabilities](https://securereading.com/pgadmin-4-vulnerabilities/)
- [pgAdmin Development Team News Archive](https://www.pgadmin.org/news/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0900