CVE-2026-12050 pgAdmin 4: SQL injection in named restore point endpoint

Medium 5.3 Published 18 Jun 2026 Updated 22 Jun 2026

Authenticated users can inject SQL via the named restore point endpoint, potentially bypassing application-layer query restrictions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-12050?

CVE-2026-12050 is a medium-severity SQL injection vulnerability in pgadmin.org pgAdmin 4, published on 18 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint.

The injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate.

Fix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string.

This issue affects pgAdmin 4: from 1.0 before 9.16.

Weakness: CWE-89

Which versions are affected by CVE-2026-12050?

It affects 1 product.

Products include Pgadmin Pgadmin 4.

How do I fix CVE-2026-12050?

Upgrade to a fixed version.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-12050 being exploited?

There is no known exploitation of CVE-2026-12050 in the wild and no public exploit code.

Sources

Also known as GHSA-v395-x24j-4r3g.