Vulnerability · Published May 11, 2026 · Assigned by PostgreSQL

CVE-2026-7815pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution

High 8.8

In plain English

A high-severity SQL injection in pgAdmin 4 from pgadmin.org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 60.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host. Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter. This issue affects pgAdmin 4: before 9.15.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	pgadmin4	9.15	GHSA-hp84-p2gq-6fvr
PyPI	pgadmin4	9.15	PYSEC-2026-2867

Affected products (as reported)

Vendor	Product	Versions
pgadmin.org	pgAdmin 4	7.6 – before 9.15

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/pgadmin-org/pgadmin4/issues/9898 issue-tracking