pgAdmin 4 CVE-2026-12048: Critical Stored XSS — Upgrade to v9.16 Now

pgAdmin 4 is the standard GUI for PostgreSQL. Most teams with a Postgres database have it running somewhere: a developer’s laptop, a bastion host, a shared ops workstation. On June 19, 2026, a disclosure landed that affects every pgAdmin 4 version from 6.0 to 9.15: a stored cross-site scripting vulnerability with a CVSS score of 9.3.

If you run pgAdmin 4, you should be on v9.16 before you read another paragraph.

What the vulnerability is

CVE-2026-12048 is a stored XSS. It does not require the user to click a malicious link or visit a crafted URL. The attack path runs through the database connection itself.

When pgAdmin displays an error from a PostgreSQL server (something like a “relation does not exist” message), it includes the relation name in the error text. That error text gets passed through html-react-parser, which is designed to render HTML strings into React elements. The problem is that pgAdmin passed unescaped server output directly to the parser without sanitizing it first.

The same issue exists in EXPLAIN plan output. Fields like Recheck Cond and Exact Heap Blocks from a query plan are also rendered via the parser.

An attacker who controls the server (or can influence what the server returns) sends back a crafted error message or plan output containing HTML and JavaScript. pgAdmin renders it. The attacker’s JavaScript now runs in the user’s browser session.

The immediate consequence: the attacker redirects the pgAdmin browser tab to a phishing page. Because pgAdmin users are typically database administrators, this is a targeted path to capturing credentials from a high-privilege user.

The attack path in concrete terms

A typical scenario with a team pgAdmin deployment:

1. A developer connects pgAdmin to an internal staging database. Unknown to them, that staging database’s schema has been manipulated by an earlier intrusion. An attacker added a table with a specially crafted name.
2. When pgAdmin queries for the table and receives an error referencing the table name, the crafted name is rendered by html-react-parser as live HTML.
3. A JavaScript redirect fires. The pgAdmin tab navigates to a convincing fake login page.
4. The developer types their real credentials to “re-authenticate.”

This does not require the attacker to have persistent access to the machine running pgAdmin. It requires only that pgAdmin connects to a database the attacker can influence at least once.

What else shipped in the June 2026 pgAdmin advisory

CVE-2026-12048 is the headline, but the v9.16 release patches a cluster of vulnerabilities:

CVE-2026-12044 — AI assistant bypass (CVSS 9.0). pgAdmin 4 added an AI assistant feature in a recent version. This vulnerability allows the assistant’s restrictions to be bypassed, potentially allowing SQL queries outside the intended scope to be issued on behalf of the user.

CVE-2026-12046 — SQL injection in the query tool (CVSS 8.8). The maintenance and query tools in pgAdmin pass certain parameters to the database without adequate parameterization. An attacker with pgAdmin access can inject arbitrary SQL, including commands that run outside the current user’s intended query.

CVE-2026-12045. Additional flaw patched in the same release. Check the official advisory for current details.

CVE-2026-7815 — SQL injection in the Maintenance Tool, also tracked in the GitHub Advisory Database (GHSA-hp84-p2gq-6fvr). This affects the maintenance dialog specifically.

Taken together, this is one of the heavier pgAdmin patch drops in recent memory. It is not a routine update.

How to check your version and upgrade

# In pgAdmin, go to Help > About to see your version
# Or check your system package

# For pip-installed pgAdmin:
pip show pgadmin4 | grep Version

# For system packages (Debian/Ubuntu):
dpkg -l | grep pgadmin4

# For macOS with Homebrew:
brew info pgadmin4

# For Windows: check Add/Remove Programs or the pgAdmin installer version

The fix is pgAdmin 4 v9.16. Download it from the official pgAdmin site or upgrade your system package:

# pip:
pip install --upgrade pgadmin4

# Debian/Ubuntu via apt (if the pgAdmin APT repo is configured):
apt update && apt install pgadmin4

# Homebrew:
brew upgrade pgadmin4

After upgrading, confirm the version shows 9.16 or later before connecting to any external database.

Risk triage by environment

Shared team pgAdmin (highest risk). If multiple people share a pgAdmin instance or connect to databases that external parties may have influenced, treat this as urgent. The phishing and credential-harvest risk is real when the users are DBAs.

Individual developer workstation connecting to own databases (lower risk). You are unlikely to encounter a crafted server error unless your database server itself is compromised. Still, upgrade — there is no reason to stay exposed.

pgAdmin not internet-exposed but on an internal network. The attack requires a malicious server, not network access to pgAdmin. Internal positioning does not eliminate the risk if the connected databases are multi-tenant or accessible to other teams.

pgAdmin not installed. If your team uses other PostgreSQL clients (DBeaver, DataGrip, psql directly), you are not affected by this CVE. It is specific to pgAdmin 4.

No workaround — patch is the only fix

No configuration option disables the vulnerable rendering path. The fix requires the parser changes in v9.16 that properly sanitize server output before it reaches html-react-parser.

If upgrading immediately is not possible (staged rollout, packaged deployment), consider restricting pgAdmin to connections against read-only replicas or databases with tightly controlled schemas until the patch is applied. This reduces exposure but does not eliminate it.

For teams that moved their database administration to a dedicated security-reviewed tool or a bastion with strict access controls, this is a reminder that developer tools in the database access path carry real attack surface. The same thought applies to reviewing other developer-facing tools. See how teams approach layered security in DevSecOps pipelines for a broader framing.

The bottom line: upgrade to pgAdmin 4 v9.16. It patches a 9.3 CVSS stored XSS, a 9.0 AI assistant bypass, and two SQL injection vulnerabilities in a single release. All four are serious on their own. Together they are a strong reason to move fast.