CVE-2026-12045

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 9.13 through 9.15

Description A read-only transaction bypass exists in the pgAdmin 4 AI Assistant, allowing an attacker who can influence database content read by the assistant to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The execute sql query() tool runs LLM-generated SQL within a BEGIN TRANSACTION READ ONLY wrapper. However, because the query was forwarded to the database driver without restricting it to a single statement or read-only verbs, a multi-statement payload starting with COMMIT, END, ROLLBACK, or ABORT can terminate the read-only transaction and execute subsequent statements in autocommit mode.

This is achieved via prompt injection, where an attacker writes malicious content into objects the AI Assistant may inspect, such as rows, column values, or comments. This causes the LLM to emit the payload as a tool call. Depending on the user's role, this can lead to unauthorized data modification or, if the user is a PostgreSQL superuser or holds pg execute server program, remote code execution on the database server host via COPY ... TO PROGRAM.

Recommendations Update pgAdmin 4 to version 9.16.