CVE-2026-12050

SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint. The injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate. Fix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string. This issue affects pgAdmin 4: from 1.0 before 9.16.

• CWE-89

• https://github.com/pgadmin-org/pgadmin4/commit/3379c39865d3ab6f52afce97361fb16bcdd77cd2Patch
• https://github.com/pgadmin-org/pgadmin4/issues/10026Issue Tracking, Patch

Published

Jun 19, 2026

Last Modified

Jun 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12044SQL injection in pgAdmin 4 across every dialog template that…8.8
• CVE-2026-12045Read-only transaction bypass in the pgAdmin 4 AI Assistant a…8.8
• CVE-2026-12046Two state-mutating endpoints in pgAdmin 4's SQL Editor bluep…9.5
• CVE-2026-12047HTML injection in pgAdmin 4's cloud deployment module. The v…5.4
• CVE-2026-12048Stored cross-site scripting in pgAdmin 4's error-rendering a…5.4
• CVE-2026-12049Open redirect in pgAdmin 4's multi-factor authentication flo…6.1
• CVE-2026-12051The USB DFU class implementation in Zephyr's new (experiment…4.6
• CVE-2026-12052The USB device-side CDC NCM class control-to-host handler us…5.2
• CVE-2026-12053GitLab has remediated an issue in GitLab EE affecting all ve…7.5
• CVE-2026-12057When the application executes the JavaScript script embedded…7.8
• CVE-2026-12058The connection confirmation pop-up of a specific feature in …5.3
• CVE-2026-12059The SSH service of CelloOS developed by Cellopoint has an Im…8.8