External risk intelligence

pgAdmin 4 SQL Injection via AI Assistant Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-17351

pgAdmin is a database management tool typically deployed in internal, administrative network segments rather than exposed directly to the public internet. While it is a web-based application, it is intended for use by database administrators behind organizational firewalls and access controls, making direct public exposure uncommon in standard deployments.

SQL Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security flaw in pgAdmin 4, a tool used for managing databases. The vulnerability could allow an attacker to bypass previous security fixes, potentially leading to unintended actions within the database environment if an attacker can trick the AI Assistant into executing specially crafted commands. The main concern is confirming relevance and exposure for your specific deployment.

Allows bypass of database command controls.
Reintroduces a prior, serious security risk.
Confirm if this tool is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by planting a malicious query in an object that the AI Assistant can read, such as a database comment or description. When the AI Assistant processes this object, it will attempt to execute the query. The vulnerability lies in how the query is parsed and executed, allowing smuggled commands to bypass security measures and potentially lead to arbitrary SQL execution or remote code execution.

Entry: Attacker plants a payload in AI Assistant readable object.
Trigger: AI Assistant's tool call executes the crafted query.
Risk: Allows database write or remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a crafted prompt could cause pgAdmin to execute unintended SQL statements. This is possible when an attacker plants a malicious payload in an object that the AI Assistant may read, leading the LLM to emit it as a tool call. The vulnerability allows for the bypass of security measures intended to prevent SQL injection and potential remote code execution.

Sensitive data or system control could be at risk.
Via indirect prompt-injection delivery.
Could lead to unintended SQL execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a real-world scenario, the pgAdmin application owners and the infrastructure teams responsible for its deployment are likely to own this issue. The first practical move is to identify all instances of pgAdmin, confirm their accessibility and business criticality, and then locate the accountable owner to plan remediation.

Application owners should manage the issue.
Verify pgAdmin accessibility and criticality.
Plan remediation based on exposure risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is pgAdmin 4 and how is it used?

pgAdmin 4 is a widely used web-based administration and development platform for PostgreSQL databases. It provides a graphical interface for developers and database administrators to manage, query, and maintain database objects. Because it allows users to interact with database structures, it is a critical administrative tool within an organization's internal data management ecosystem.

What does CVE-2026-17351 mean in plain English?

This vulnerability involves Improper Neutralization of Special Elements used in an SQL Command (CWE-89). It allows an attacker to bypass security controls designed to restrict the AI Assistant's database interactions. By exploiting a discrepancy in how different components interpret string literals, an attacker can smuggle unauthorized commands past the application's validator, resulting in unintended SQL execution or potential remote code execution.

How can this vulnerability be triggered?

An attacker triggers this by planting a malicious payload into any database object the AI Assistant might read, such as a table comment or description. When the AI Assistant retrieves this object and includes it in a tool call, the pgAdmin backend processes the injected query. The vulnerability is not triggered by standard, benign SQL usage, but specifically relies on the delivery of a crafted payload via indirect prompt injection.

Is my instance of pgAdmin 4 at risk?

Halo Surface Signal indicates this risk is 'Possible' but emphasizes that pgAdmin is typically deployed in internal, administrative network segments rather than directly on the public internet. While it is a web application, its standard use case involves protected, internal access. Instances located behind strong organizational firewalls and access controls face a lower immediate risk than those exposed to untrusted users.

What should I do to address CVE-2026-17351?

Your first step is to perform an internal inventory to identify all active instances of pgAdmin 4 within your environment. Once mapped, assess which installations are accessible to users who might plant malicious content. Finally, coordinate with the application owners to plan for the official software update that patches this execution bypass, ensuring the fix is applied to all instances.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.