CVE-2026-17346 pgadmin.org CVE debrief

Who should care

pgAdmin 4 users and administrators, especially those with low-privileged users, should be aware of this vulnerability and take necessary actions to mitigate it. This includes upgrading to version 9.17 or later, implementing compensating controls such as Web Application Firewalls (WAFs), monitoring database activity for suspicious SQL queries, restricting database privileges to the minimum required, and regularly reviewing and updating pgAdmin 4 configurations and ALLOWLIST entries.

Technical summary

The CVE-2026-17346 vulnerability in pgAdmin 4 arises from the incomplete fix for CVE-2026-12044. The fix for CVE-2026-12044 hardened qtLiteral and switched several COMMENT ON / pgstattuple / pgstatindex templates to it but missed several sinks in test_sql_string_literal_lint.py's ALLOWLIST. These missed sinks include the Index Statistics query for all-indexes listing and the publication and subscription dependencies.sql / get_position.sql templates. A low-privileged user can exploit this by creating a table, publication, or subscription with an apostrophe'd name, which can then be used to inject arbitrary SQL statements when another user views the object's Statistics or Dependencies tab.

Defensive priority

This issue is of high severity with a CVSS score of 8.7 and could allow a low-privileged user to inject arbitrary SQL statements in the viewing user's database session.

Recommended defensive actions

• Inventory and assess pgAdmin 4 installations for version 9.16 or earlier and upgrade to version 9.17 or later.
• Implement compensating controls such as Web Application Firewalls (WAFs) to detect and prevent SQL injection attacks.
• Monitor database activity for suspicious SQL queries that could indicate exploitation attempts.
• Restrict database privileges to the minimum required for users to perform their tasks.
• Regularly review and update pgAdmin 4 configurations and ALLOWLIST entries to ensure they are secure and up-to-date.

Evidence notes

The CVE-2026-17346 issue arises from the fix for CVE-2026-12044 in pgAdmin 4 version 9.16, which inadvertently left several sinks unhardened against SQL injection. Specifically, the fix missed sinks in test_sql_string_literal_lint.py's ALLOWLIST, assuming that schema, table, publication, and subscription names from pg_catalog via the browser tree could not contain an apostrophe. However, PostgreSQL allows arbitrary characters in quoted identifiers, enabling a low-privileged user to create an object with an apostrophe'd name. This can break the unescaped '{{ name }}' template interpolation when any user views the object's Statistics or Dependencies tab, leading to arbitrary SQL statement injection.

Official resources