Critical [CVE-2026-12046] pgAdmin 4: Remote Code Execution due to missing authentication on critical functions
This critical-severity Red Hat Linux advisory covers CVE-2026-12046.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/ and POST /sqleditor/initialize/sqleditor/update_connection/// -- were the only routes in the module missing the @pga_login_required decorator.
Both reach a pickle.loads sink on session['gridData'][]['command_obj']: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session.
The defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502).
Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin's Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin's sessions/ directory on the host.
Neither precondition is granted by this defect on its own.
- < 6.9
- < 9.16
Official advisory · high-confidence parse· fetched 24 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 24 days ago·verify at source
Mitigation checklist
- To mitigate the risk, restrict network access to the pgAdmin 4 server. Configure firewall rules to allow connections only from trusted internal networks or localhost. For example, using `firewalld` on Red Hat Enterprise Linux, administrators can limit inbound traffic to the pgAdmin 4 listening port. This action may affect remote access to the pgAdmin 4 interface.
Official advisory · high-confidence parse· fetched 24 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.