# CVE-2026-12046: Deserialization in pgAdmin 4 > Unauthenticated pickle deserialization in pgAdmin 4 server mode allows remote code execution if attacker possesses session key and write access. - **Severity:** Critical 9.5 (`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 18 Jun 2026 - **Updated:** 23 Jun 2026 - **Also known as:** GHSA-mmqg-h4qx-g8qv ## What is CVE-2026-12046? CVE-2026-12046 is a critical unsafe deserialization vulnerability in pgadmin.org pgAdmin 4, published on 18 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/ and POST /sqleditor/initialize/sqleditor/update_connection/// -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session['gridData'][]['command_obj']: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session. The defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin's Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin's sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin. Fix is a one-line @pga_login_required decorator on each of the two endpoints, matching the convention used by every other route in the module. The is_authenticated / MFA chain now runs before the trans_id is dereferenced, so an unauthenticated request is rejected before reaching the deserialization path. The defect is server-mode only. In DESKTOP mode pgAdmin's before_request hook re-authenticates DESKTOP_USER on every request, so no endpoint can be exercised in an unauthenticated state and no auth decorator (or its absence) is meaningful. The accompanying regression test mirrors the attacker's path -- harvests an X-pgA-CSRFToken from GET /login and replays it against both endpoints -- and self-skips outside server mode for that reason; it is wired into the existing server-mode CI workflow alongside the data-isolation tests. This issue affects pgAdmin 4: from 6.9 before 9.16. Weakness: CWE-502 (Deserialization of Untrusted Data), CWE-306 (Missing Authentication for Critical Functionality) ## Which versions are affected by CVE-2026-12046? It affects 1 product. Products: Pgadmin Pgadmin 4. ## How do I fix CVE-2026-12046? Apply the vendor's patch. ## Is CVE-2026-12046 being exploited? There is no known exploitation of CVE-2026-12046 in the wild and no public exploit code. ## Other vulnerabilities in pgadmin.org pgAdmin 4 - [CVE-2025-2945](https://insights.sbomify.com/CVE-2025-2945/): pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment (critical 9.9) - [CVE-2024-9014](https://insights.sbomify.com/CVE-2024-9014/): OAuth2 client id and secret exposed through the web browser in pgAdmin 4 (critical 9.9) - [CVE-2026-17351](https://insights.sbomify.com/CVE-2026-17351/): SQL injection in pgAdmin 4 (critical 9.4) - [CVE-2026-17566](https://insights.sbomify.com/CVE-2026-17566/): Command injection in pgAdmin 4 (critical 9.4) - [CVE-2026-12045](https://insights.sbomify.com/CVE-2026-12045/): pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution (critical 9.4) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-12046 and fix it if it is affected. What it is: CVE-2026-12046 is a critical unsafe deserialization vulnerability in pgadmin.org pgAdmin 4, published on 18 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of CVE-2026-12046 in the wild and no public exploit code. Affected product: pgadmin.org pgAdmin 4. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-12046/ (Markdown: https://insights.sbomify.com/CVE-2026-12046/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-12046 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12046 - OSV: https://osv.dev/vulnerability/CVE-2026-12046 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-12046/ Summaries are generated and may contain mistakes; the official description above is the record.