CVE Intelligence
Analysis AI-assisted

CVE-2026-12046: pgAdmin 4 SQL Editor missing authentication leading to unsafe deserialization

Two SQL Editor endpoints in pgAdmin 4 server mode lacked the login-required check and reach a pickle deserialization sink, affecting versions from 6.9 before 9.16. Remote code execution additionally requires knowledge of the Flask SECRET_KEY and write access to pgAdmin's sessions directory, so the flaw mainly amplifies an existing partial compromise. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-12046 is a missing-authentication flaw (CWE-306) in the SQL Editor module of pgAdmin 4. Two state-changing routes, one that closes a SQL Editor session and one that updates its connection, were the only routes in the module without the @pga_login_required decorator. Both code paths eventually deserialize data stored in the user session with Python's pickle, a deserialization-of-untrusted-data pattern (CWE-502). In server mode these routes could be reached without an authenticated pgAdmin session.

Impact

The CNA rates the issue critical: CVSS 3.1 score 9.0 (vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and a CVSS 4.0 score of 9.5. The high attack complexity reflects important preconditions: to achieve code execution an attacker must also forge a server-side session file containing a malicious serialized object, which requires both knowledge of pgAdmin's Flask SECRET_KEY and write access to the sessions directory on the host. This defect grants neither. Where those conditions already exist through another channel (misconfiguration, leaked configuration, prior compromise), the missing check becomes the final step to unauthenticated code execution inside the pgAdmin process, under the operating system account running pgAdmin.

Affected products and versions

  • pgAdmin 4 from version 6.9 up to, but not including, 9.16.
  • Only server mode deployments are affected. In desktop mode, pgAdmin re-authenticates the desktop user on every request, so the routes cannot be reached unauthenticated.

Exploitation status

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

  • Upgrade pgAdmin 4 to 9.16 or later; the affected range ends before 9.16. The fix adds the login-required decorator to both routes so unauthenticated requests are rejected before deserialization (commit, issue 10072).
  • Protect the Flask SECRET_KEY: keep configuration files out of shared or exposed locations and rotate the key if exposure is suspected.
  • Restrict file system permissions on pgAdmin's sessions directory so only the pgAdmin service account can write to it.
  • Avoid exposing pgAdmin server-mode instances directly to the internet; place them behind a VPN, reverse proxy with authentication, or network allowlists.
  • Run pgAdmin under a least-privileged account to limit the blast radius of any code execution.

Detection guidance

  • Review web server or reverse proxy logs for requests to the SQL Editor close and update-connection routes that do not belong to an authenticated session, especially from unfamiliar sources.
  • Monitor the sessions directory for unexpected file creation or modification by accounts other than the pgAdmin service.
  • Watch for unusual child processes or outbound connections spawned by the pgAdmin process.
  • Audit for signs that the SECRET_KEY or configuration files may have been leaked.

Limitations of the available information

The record contains no EPSS or SSVC data. It does not describe any method to obtain the SECRET_KEY or gain write access to the sessions directory, and no public exploitation reports are referenced. The fixed release is inferred from the affected range ending before 9.16; consult the project's release notes to confirm packaging for your distribution.

Frequently asked questions

Which pgAdmin 4 versions are affected by CVE-2026-12046?

pgAdmin 4 from 6.9 up to, but not including, 9.16, and only when running in server mode.

Can an unauthenticated attacker run code using only this flaw?

No. Code execution also requires knowledge of pgAdmin's Flask SECRET_KEY and write access to its sessions directory, which this defect does not provide.

Is CVE-2026-12046 being exploited?

It is not in the CISA KEV catalog and no confirmed exploitation appears in the sources consulted.

How do I fix it?

Upgrade to 9.16 or later, which adds the login-required check to both routes, and protect the SECRET_KEY and sessions directory permissions.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.