CVE-2026-116241

Summary

pgAdmin 4's Import/Export Data tool incorrectly validated SQL queries by rejecting backslashes in single-quoted strings but not in double-quoted identifiers, allowing an attacker to bypass the wrapper and inject a psql TO PROGRAM clause that executes arbitrary commands on the host as the pgAdmin service account.

Exploitability

Exploitation requires valid database credentials (low-privilege roles suffice) and the ability to craft a malicious query with a backslash-escaped double quote inside a double-quoted identifier, which is feasible due to inconsistent quoting handling between pgAdmin's validation and psql's parser when standard_conforming_strings is disabled.

Blast radius

Successful exploitation grants remote code execution on the pgAdmin host as the service account, potentially compromising the entire system and enabling lateral movement within the database environment.

Detection

Monitor for psql command-line invocations containing 'TO PROGRAM' in pgAdmin service logs or process execution logs on the host; also watch for unexpected child processes spawned by the pgAdmin service with non-standard command-line arguments.

Prioritized remediation

Upgrade to pgAdmin 4 version 9.19 or later, which patches the validation logic to reject backslashes in double-quoted identifiers.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.