Introduction
A SQL injection flaw in pgAdmin 4's Maintenance Tool lets an authenticated user turn a simple parameter injection into full operating system command execution on the database host. For organizations that rely on pgAdmin as their primary PostgreSQL management interface, this vulnerability (scored CVSS 8.8) is a direct path from a web application compromise to control of the underlying server.
pgAdmin is the most popular and feature-rich open-source administration and development platform for PostgreSQL. It is the default graphical management tool for PostgreSQL deployments across enterprises, cloud environments, and development teams worldwide. Because it is the primary administrative interface for one of the most widely deployed open-source databases, security issues in pgAdmin have outsized impact.
Technical Information
The root cause of CVE-2026-7815 is how the pgAdmin 4 Maintenance Tool builds SQL commands for VACUUM, ANALYZE, and REINDEX operations. Four user-supplied JSON fields are concatenated directly into the rendered command string and passed to psql --command without sanitization or validation:
| Vulnerable JSON Field | Affected Commands |
|---|---|
buffer_usage_limit | VACUUM, ANALYZE, REINDEX |
vacuum_parallel | VACUUM, ANALYZE, REINDEX |
vacuum_index_cleanup | VACUUM, ANALYZE, REINDEX |
reindex_tablespace | VACUUM, ANALYZE, REINDEX |
When a user triggers a maintenance operation through the pgAdmin web interface, the backend takes the values from these JSON fields and embeds them directly into the SQL command string. It does no allow listing and no parameterized construction. For reindex_tablespace, it applies only manual quoting, which can be bypassed.
Attack Flow
Exploitation takes five steps:
-
The attacker authenticates to the pgAdmin 4 web interface. They must hold the
tools_maintenancepermission, which grants access to the Maintenance Tool. -
The attacker starts a maintenance operation (for example, a VACUUM) and supplies a crafted value in one of the four vulnerable JSON fields. The payload is designed to break out of the expected option syntax.
-
The pgAdmin backend concatenates the attacker-controlled value directly into the SQL command string without validation.
-
pgAdmin passes the command to
psql --command, which runs it against the connected PostgreSQL server. The injected SQL executes with the privileges of the active database connection. -
To escalate beyond database-level access, the attacker uses PostgreSQL's
COPY ... TO PROGRAMstatement. This built-in PostgreSQL feature, available to superusers, runs arbitrary operating system commands on the database host with the privileges of the PostgreSQL service account.
The COPY ... TO PROGRAM escalation path is well documented and requires no novel techniques. If the pgAdmin connection uses a superuser role, which is common in administrative deployments, the path from SQL injection to full OS command execution is direct.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Low attack complexity and no required user interaction, combined with high impact on all three CIA triad dimensions, justify the 8.8 score.
Fix Details
Version 9.15 (commit cf53953d9) fixes the issue with two changes:
- The server now allow lists all four vulnerable JSON fields, so only expected values pass through.
- The
qtIdentfilter replaces the manual quoting ofreindex_tablespaceand applies proper PostgreSQL identifier escaping.
Affected Systems and Versions
The vulnerability affects pgAdmin 4 versions from 7.6 up to (but not including) 9.15. Any deployment in this range is vulnerable if users holding the tools_maintenance permission can reach the Maintenance Tool.
The fixed version is pgAdmin 4 9.15.
Vendor Security History
pgAdmin's operational tooling has a pattern of command execution vulnerabilities:
| CVE Identifier | Affected Version | Vulnerability Type | Impact |
|---|---|---|---|
| CVE-2026-7815 | 7.6 to before 9.15 | SQL Injection | OS Command Execution via COPY TO PROGRAM |
| CVE-2026-1707 | 9.11 | Restore Restriction Bypass | Command execution during restore operations |
CVE-2026-1707 let attackers with web interface access extract a restriction key and overwrite restore scripts, which gave them reliable command execution on the pgAdmin host. Command execution risks have now recurred in pgAdmin's administrative tooling, so treat pgAdmin instances as high-value targets and apply updates promptly.
