CVE-2026-7815: pgAdmin 4 SQL Injection Vulnerability

CVE-2026-7815 Overview

CVE-2026-7815 is a SQL injection vulnerability [CWE-89] in the pgAdmin 4 Maintenance Tool. The flaw exists in how the tool builds VACUUM, ANALYZE, and REINDEX commands that are passed to psql --command. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, and reindex_tablespace) are concatenated directly into the rendered command without validation.

An authenticated user holding the tools_maintenance permission can break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL can invoke COPY ... TO PROGRAM to escalate to operating system command execution on the database host. The vulnerability affects pgAdmin 4 versions before 9.15.

Critical Impact

Authenticated attackers can execute arbitrary SQL and pivot to OS command execution on the PostgreSQL host via COPY ... TO PROGRAM.

Affected Products

• pgAdmin 4 versions prior to 9.15
• pgAdmin 4 Maintenance Tool component
• PostgreSQL instances connected through vulnerable pgAdmin 4 deployments

Discovery Timeline

• 2026-05-11 - CVE-2026-7815 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-7815

Vulnerability Analysis

The pgAdmin 4 Maintenance Tool generates PostgreSQL maintenance commands from JSON parameters submitted by authenticated users. The server-side rendering logic concatenates four user-controlled values directly into the command string before invoking psql --command. No input validation or allow-listing is performed on buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, or reindex_tablespace prior to the fix.

An attacker with the tools_maintenance permission can inject SQL syntax through any of these four fields. The injected payload exits the intended option context and runs as part of the maintenance command executed against the target database. Because the resulting SQL runs with the privileges of the connected PostgreSQL role, attackers can leverage COPY ... TO PROGRAM to spawn arbitrary processes on the database server. This converts a database-layer flaw into full operating system command execution on the PostgreSQL host.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The Maintenance Tool relied on manual quoting for reindex_tablespace and accepted the other three fields without sanitization. The fix introduces server-side allow-listing for all four fields and replaces manual quoting of reindex_tablespace with the qtIdent filter, which safely quotes PostgreSQL identifiers.

Attack Vector

Exploitation requires an authenticated pgAdmin 4 session with the tools_maintenance permission and network access to the pgAdmin web interface. The attacker submits a crafted Maintenance Tool request containing malicious values in one of the four affected JSON fields. The rendered command is passed to psql --command, which executes the injected SQL against the connected PostgreSQL server. Follow-on use of COPY ... TO PROGRAM yields command execution on the database host. See the GitHub Issue Report for additional technical detail.

Detection Methods for CVE-2026-7815

Indicators of Compromise

• Unexpected psql --command invocations originating from the pgAdmin 4 process containing suspicious tokens in VACUUM, ANALYZE, or REINDEX option lists.
• PostgreSQL server logs containing COPY ... TO PROGRAM statements issued from Maintenance Tool sessions.
• Child processes spawned by the PostgreSQL server account immediately following a Maintenance Tool action.

Detection Strategies

• Audit pgAdmin 4 application logs for Maintenance Tool requests with non-standard values in buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, or reindex_tablespace.
• Enable PostgreSQL log_statement = 'all' on hosts running pgAdmin 4 and alert on COPY ... TO PROGRAM usage.
• Correlate web access logs to the pgAdmin Maintenance Tool endpoint with subsequent process creation events on the PostgreSQL host.

Monitoring Recommendations

• Monitor for new child processes of the PostgreSQL service account, especially shells, interpreters, or network utilities.
• Track authentication events for accounts granted the tools_maintenance permission and review their activity baselines.
• Forward pgAdmin 4 and PostgreSQL logs to a centralized SIEM and build identifications around the patterns above.

How to Mitigate CVE-2026-7815

Immediate Actions Required

• Upgrade pgAdmin 4 to version 9.15 or later on all servers and workstations.
• Restrict the tools_maintenance permission to a minimal set of trusted administrators.
• Review PostgreSQL logs for prior use of COPY ... TO PROGRAM originating from Maintenance Tool sessions.
• Rotate credentials for any PostgreSQL roles configured in pgAdmin if compromise is suspected.

Patch Information

The pgAdmin project fixed CVE-2026-7815 in pgAdmin 4 version 9.15. The patch introduces server-side allow-listing of buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, and reindex_tablespace. It also switches reindex_tablespace from manual quoting to the qtIdent identifier-quoting filter. Refer to the GitHub Issue Report for fix details.

Workarounds

• Revoke the tools_maintenance permission from non-administrator pgAdmin users until patching is complete.
• Place pgAdmin 4 behind network segmentation that restricts access to a small administrator subnet.
• Run PostgreSQL under an unprivileged service account to limit impact of COPY ... TO PROGRAM abuse.
• Disable interactive shells for the PostgreSQL service account to constrain post-exploitation pivoting.

# Upgrade pgAdmin 4 to a fixed release (example for pip-based installs)
pip install --upgrade "pgadmin4>=9.15"

# Verify the installed version
pgadmin4 --version

# In the pgAdmin UI: Management > Roles
# Remove the tools_maintenance permission from non-admin roles