CVE-2026-119426 phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql

What is CVE-2026-119426?

CVE-2026-119426 is a high-severity vulnerability in phpMyAdmin, published on 30 Oct 2026.

Official description

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.

Weakness: CWE-352

Which versions are affected by CVE-2026-119426?

It affects 1 product.

Products include phpMyAdmin.

How do I fix CVE-2026-119426?

No fix has been published for CVE-2026-119426 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119426 being exploited?

There is no known exploitation of CVE-2026-119426 in the wild and no public exploit code.

Other vulnerabilities in phpMyAdmin

• CVE-2008-7251 libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 creates a temporary directory with 0777 permissions, which has unknown impact and attack vectors. Critical 10.0
• CVE-2008-7252 phpMyAdmin unsafely handles temporary files Critical 10.0
• CVE-2007-0203 Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors. Critical 10.0
• CVE-2004-1147 phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary c Critical 10.0
• CVE-2020-22452 phpmyadmin contains SQL Injection vulnerability Critical 9.8

All phpMyAdmin vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-119426, GHSA-5vv2-vq4f-4f39, UBUNTU-CVE-2026-119426.