# CVE-2026-17351: SQL injection in pgAdmin 4 > Attackers can bypass read-only transaction restrictions in pgAdmin 4's AI Assistant via SQL injection, enabling arbitrary code execution and data modification. - **Severity:** Critical 9.4 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 31 Jul 2026 - **Updated:** 1 Aug 2026 - **Also known as:** GHSA-v5gm-27gp-4f7w ## What is CVE-2026-17351? CVE-2026-17351 is a critical SQL injection vulnerability in pgadmin.org pgAdmin 4, published on 31 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. ### Official description The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing can disagree with PostgreSQL's own parser: under standard_conforming_strings = on (PostgreSQL's default since 9.1), a backslash immediately before a quote is an ordinary character to PostgreSQL, but sqlparse treats it as escaping the quote. A payload such as SELECT '\';COMMIT;CREATE TABLE pwn(x int);SELECT 1 --' therefore parses as a single SELECT to sqlparse's validator, while PostgreSQL executes it as four statements: the smuggled COMMIT ends the wrapping read-only transaction, and the trailing ROLLBACK becomes a no-op. This reintroduces the same write/RCE bypass CVE-2026-12045 was meant to close, reachable via the same indirect prompt-injection delivery (an attacker plants the payload in any object the AI Assistant may read; the LLM emits it as a tool call). An initial candidate fix ran the query with psycopg's execute(..., prepare=True), intending to force PostgreSQL's own Parse step (extended query protocol) to reject multi-statement text regardless of sqlparse's classification. This candidate fix does not work as submitted: psycopg3's PrepareManager silently ignores the prepare argument whenever the connection's prepare_threshold is None, which is pgAdmin's default for every server connection (the per-server "Prepare threshold" field is blank unless an administrator explicitly sets it) -- psycopg3 falls back to the simple query protocol, the same multi-statement-capable path the bypass exploits, so the candidate fix closes nothing on any real-world default configuration. The corrected fix sets conn.prepare_threshold = 0 directly on the dedicated, single-use read-only connection the AI Assistant tool opens, structurally forcing the extended query protocol independent of any server-level configuration. Verified against a live PostgreSQL 18 instance: the payload executes successfully under the prepare_threshold=None (default) behavior, and is rejected with "cannot insert multiple commands into a prepared statement" once prepare_threshold=0 is set on that connection. This issue affects pgAdmin 4: from 9.13 before 9.17. Weakness: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), CWE-115 (Misinterpretation of Input) ## Which versions are affected by CVE-2026-17351? It affects 1 product. Products: Pgadmin Pgadmin 4. ## How do I fix CVE-2026-17351? Apply the vendor's patch. ## Is CVE-2026-17351 being exploited? There is no known exploitation of CVE-2026-17351 in the wild and no public exploit code. Public exploit code: - https://github.com/Hunt-Benito/pgadmin-ai-assistant-sql-injection-cve-2026-17351-lexer-differential-bypass (github_poc): https://github.com/Hunt-Benito/pgadmin-ai-assistant-sql-injection-cve-2026-17351-lexer-differential-bypass ## Other vulnerabilities in pgadmin.org pgAdmin 4 - [CVE-2025-2945](https://insights.sbomify.com/CVE-2025-2945/): pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment (critical 9.9) - [CVE-2024-9014](https://insights.sbomify.com/CVE-2024-9014/): OAuth2 client id and secret exposed through the web browser in pgAdmin 4 (critical 9.9) - [CVE-2026-12046](https://insights.sbomify.com/CVE-2026-12046/): Deserialization in pgAdmin 4 (critical 9.5) - [CVE-2026-17566](https://insights.sbomify.com/CVE-2026-17566/): Command injection in pgAdmin 4 (critical 9.4) - [CVE-2026-12045](https://insights.sbomify.com/CVE-2026-12045/): pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution (critical 9.4) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-17351 and fix it if it is affected. What it is: CVE-2026-17351 is a critical SQL injection vulnerability in pgadmin.org pgAdmin 4, published on 31 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of CVE-2026-17351 in the wild and no public exploit code. Affected product: pgadmin.org pgAdmin 4. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-17351/ (Markdown: https://insights.sbomify.com/CVE-2026-17351/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-17351 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17351 - OSV: https://osv.dev/vulnerability/CVE-2026-17351 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-17351/ Summaries are generated and may contain mistakes; the official description above is the record.