pgAdmin 4 CVE-2026-12046

Target must be running pgAdmin 4 between 6.9 and 9.15 inclusive in SERVER mode (DESKTOP mode is immune because the before_request hook re-authenticates DESKTOP_USER on every request). The attacker reaches the vulnerable routes with only a CSRF token harvested from an unauthenticated GET /login and no pgAdmin session cookie. To escalate from reaching the pickle.loads sink to actual code execution the attacker must independently possess (a) the Flask SECRET_KEY used to sign session files and (b) write access to pgAdmin's sessions/ directory on the host so a forged session containing a malicious gridData[trans_id]['command_obj'] pickle is loaded; neither precondition is granted by this defect alone, and the CVSS 4.0 AT:P metric reflects exactly this.

The CVSS 4.0 score of 9.5 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) leans heavily on full-system impact and AT:P (attack requirements present), which correctly captures that exploitation depends on SECRET_KEY knowledge plus write access to sessions/ - neither granted by this defect alone. In isolation the missing auth gate only exposes a pickle sink; weaponized RCE requires a separate prior compromise (misconfigured deployment, leaked configuration, host-side write access). There is no EPSS score, no KEV listing, and no public exploit identified at time of analysis, so real-world risk is meaningful for server-mode operators with weak SECRET_KEY hygiene or co-tenanted hosts but is unlikely to drive mass exploitation. Desktop-mode installs are unaffected because the before_request hook re-authenticates DESKTOP_USER on every request, making the decorator absence inert there - this is an explicit limit, not an inference.

An attacker who has separately obtained the target's Flask SECRET_KEY (e.g., from a leaked config dump or backup) and has write access to the pgAdmin sessions/ directory (e.g., shared host, prior foothold, misconfigured volume mount) crafts a Flask session file whose gridData[trans_id]['command_obj'] is a malicious pickle payload, then sends an unauthenticated DELETE to /sqleditor/close/<trans_id> with only a CSRF token harvested from GET /login. The missing @pga_login_required decorator lets the request reach close_sqleditor_session(), pickle.loads fires on the planted payload, and arbitrary code runs as the pgAdmin process user. No public exploit is identified at time of analysis.