pgAdmin 4 CVE-2026-12050

The attacker must be an authenticated pgAdmin user with a connected PostgreSQL server session. The endpoint does not require any special configuration beyond default settings. The injected SQL executes under the same database role the user already holds, so no privilege escalation occurs. This limits the impact to actions the role already permits. Authentication requirement confirmed by CVSS:4.0/PR:L. No other prerequisites.

Despite being an SQL injection, the real-world risk is very low. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) yields a base score of 5.3, with only low integrity impact. EPSS probability is 0.21% (percentile 11%), indicating low exploitation likelihood. CISA's SSVC framework confirms no exploitation observed, not automatable, and partial technical impact. The most important mitigator is that the injected SQL executes under the attacker's database role-the same privileges they already have via pgAdmin's Query Tool-so no privilege escalation is achieved. The vulnerability only matters in environments where the Query Tool is disabled or gated at the application layer, as it provides an alternative path to SQL execution. No conflicting signals; all indicators consistently point to low priority.

An authenticated pgAdmin user with an active PostgreSQL connection sends a POST request to /browser/server/restore_point/{gid}/{sid} with a crafted 'value' field containing SQL injection payload (e.g., test'); DROP TABLE sensitive_data; --). The server interprets the payload as part of the SQL statement, executing the injected commands under the user's existing database role. No public exploit code has been identified; the regression test uses a benign payload for verification only.