CVE-2026-12045: pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

Synopsis

A read-only transaction bypass vulnerability in pgAdmin 4's AI Assistant (versions 9.13 through before 9.16) allows an attacker with low-privilege database write access to execute arbitrary SQL as the pgAdmin user's database role. The attack is delivered over the network via prompt injection: malicious content placed in any database object the AI Assistant reads causes the LLM to emit a multi-statement payload that escapes the READ ONLY transaction wrapper. Successful exploitation enables unauthorized data modification and, when the pgAdmin role is a superuser or holds pg_execute_server_program, full remote code execution on the database server host. A patched-image rebuild at pgAdmin 4 version 9.16 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the pgAdmin 4 service over the network to deliver the prompt-injection payload through database content the AI Assistant reads.

• AuthenticationRequired

  The attacker must hold at least a low-privilege account with write access to any database object the AI Assistant may inspect; no higher privilege is needed to initiate the bypass.

• Victim interactionRequired

  A pgAdmin user must trigger the AI Assistant to read the attacker-controlled content, causing the LLM to emit the malicious multi-statement tool call.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the attacker can place content in a readable database object; no race conditions or special memory-layout requirements apply.

Blast Radius

• Reads any data accessible to the pgAdmin user's database role, including table rows, column values, and stored credentials.
• Modifies or deletes persisted database rows and schema objects without authorization.
• When the pgAdmin role is a PostgreSQL superuser or holds pg_execute_server_program, executes arbitrary operating system commands on the database server host via COPY ... TO PROGRAM.
• Cascading compromise of downstream systems is possible if the database server host or its credentials are used as a trust anchor in the broader infrastructure.