CVE-2026-7815: pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution
SQL injection vulnerability in pgAdmin 4 Maintenance Tool.
Four user-supplied JSON fields (bufferusagelimit, vacuumparallel, vacuumindexcleanup, reindextablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the toolsmaintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.
Fix introduces server-side allow-listing of all four fields and switches reindextablespace from manual quoting to the qtIdent filter.
This issue affects pgAdmin 4: before 9.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgAdmin 4 Maintenance tool (SQL injection in option values)to a version that resolves this vulnerability.Fixed in 9.15 - Configuration
Apply the fix so that the four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) are allow-listed server-side and not concatenated directly into rendered VACUUM/ANALYZE/REINDEX commands.
pgAdmin 4 Maintenance tool server-side allow-listing of JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) = Enabled (allow-list all four fields) - Configuration
Apply the fix so reindex_tablespace switches from manual quoting to the qtIdent filter when building the REINDEX command.
pgAdmin 4 Maintenance tool reindex_tablespace quoting behavior = Use qtIdent filter instead of manual quoting
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7815?
The severity of CVE-2026-7815 is rated as high with a score of 8.7.
How do I fix CVE-2026-7815?
To fix CVE-2026-7815, you should apply the available patch for pgAdmin 4 as soon as possible.
What type of vulnerability is CVE-2026-7815?
CVE-2026-7815 is an SQL injection vulnerability that can lead to remote code execution.
Who is affected by CVE-2026-7815?
Authenticated users of pgAdmin 4 who utilize the Maintenance Tool are affected by CVE-2026-7815.
What could an attacker achieve by exploiting CVE-2026-7815?
An attacker exploiting CVE-2026-7815 could potentially execute arbitrary commands on the server, leading to remote code execution.