SQL injection vulnerability in pgAdmin 4 Maintenance Tool

高 8.8CVE-2026-7815 · GHSA-hp84-p2gq-6fvr · PYSEC-2026-2867 · 11/05/2026 公開 · 26/10/2026 更新

要点

CVE-2026-7815 は pgadmin4, pgadmin 4 (pgadmin) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.46%（全脆弱性の 39.6% より高い）。
対処：9.15 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
pgadmin4 PyPI	`< 9.15`	`9.15`
pgadmin 4 pgadmin	`≥ 7.6, < 9.15`	`9.15`

概要

SQL injection vulnerability in pgAdmin 4 Maintenance Tool.

Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.

Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.

This issue affects pgAdmin 4: before 9.15.

NVD の説明

SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host. Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter. This issue affects pgAdmin 4: before 9.15.