Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role.
The AI Assistant's execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect.
Delivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user's role the attacker can perform unauthorised data modification. When the pgAdmin user's role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM.
Fix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, CALL, COPY, DO, SET/RESET, and everything else are rejected before any database work happens. PostgreSQL's READ ONLY mode continues to backstop data-modifying CTEs, EXPLAIN ANALYZE on writes, and volatile side effects.
This issue affects pgAdmin 4: from 9.13 before 9.16.
References
| Link | Resource |
|---|---|
| https://github.com/pgadmin-org/pgadmin4/commit/bf4792444446f0e7ab721d23cbd6bfe6afaa7a8b | Patch |
| https://github.com/pgadmin-org/pgadmin4/issues/10022 | Issue Tracking Patch Third Party Advisory |
Configurations
History
01 Jul 2026, 19:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* | |
| First Time |
Pgadmin
Pgadmin pgadmin 4 |
|
| References | () https://github.com/pgadmin-org/pgadmin4/commit/bf4792444446f0e7ab721d23cbd6bfe6afaa7a8b - Patch | |
| References | () https://github.com/pgadmin-org/pgadmin4/issues/10022 - Issue Tracking, Patch, Third Party Advisory |
19 Jun 2026, 00:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-19 00:16
Updated : 2026-07-01 19:26
NVD link : CVE-2026-12045
Mitre link : CVE-2026-12045
CVE.ORG link : CVE-2026-12045
JSON object : View
Products Affected
pgadmin
- pgadmin_4