# CVE-2026-12045: pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

> Prompt injection in pgAdmin 4 AI Assistant bypasses read-only restrictions, allowing unauthorized SQL execution and potential remote code execution.

- **Severity:** Critical 9.4 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 18 Jun 2026
- **Updated:** 23 Jun 2026
- **Also known as:** GHSA-95q2-vx3p-f723

## What is CVE-2026-12045?

CVE-2026-12045 is a critical SQL injection vulnerability in pgadmin.org pgAdmin 4, published on 18 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

### Official description

Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role.

The AI Assistant's execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect.

Delivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user's role the attacker can perform unauthorised data modification. When the pgAdmin user's role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM.

Fix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, CALL, COPY, DO, SET/RESET, and everything else are rejected before any database work happens. PostgreSQL's READ ONLY mode continues to backstop data-modifying CTEs, EXPLAIN ANALYZE on writes, and volatile side effects.

This issue affects pgAdmin 4: from 9.13 before 9.16.

Weakness: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), CWE-77 (Improper Neutralization of Special Elements used in a Command)

## Which versions are affected by CVE-2026-12045?

It affects 1 product.


Products: Pgadmin Pgadmin 4.

## How do I fix CVE-2026-12045?

Upgrade to a fixed version.

## Is CVE-2026-12045 being exploited?

There is no known exploitation of CVE-2026-12045 in the wild and no public exploit code.

## Other vulnerabilities in pgadmin.org pgAdmin 4

- [CVE-2025-2945](https://insights.sbomify.com/CVE-2025-2945/): pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment (critical 9.9)
- [CVE-2024-9014](https://insights.sbomify.com/CVE-2024-9014/): OAuth2 client id and secret exposed through the web browser in pgAdmin 4 (critical 9.9)
- [CVE-2026-12046](https://insights.sbomify.com/CVE-2026-12046/): Deserialization in pgAdmin 4 (critical 9.5)
- [CVE-2026-17351](https://insights.sbomify.com/CVE-2026-17351/): SQL injection in pgAdmin 4 (critical 9.4)
- [CVE-2026-17566](https://insights.sbomify.com/CVE-2026-17566/): Command injection in pgAdmin 4 (critical 9.4)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-12045 and fix it if it is affected.

What it is: CVE-2026-12045 is a critical SQL injection vulnerability in pgadmin.org pgAdmin 4, published on 18 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2026-12045 in the wild and no public exploit code.

Affected product: pgadmin.org pgAdmin 4. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-12045/ (Markdown: https://insights.sbomify.com/CVE-2026-12045/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-12045
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12045
- OSV: https://osv.dev/vulnerability/CVE-2026-12045

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-12045/
Summaries are generated and may contain mistakes; the official description above is the record.