CVE-2026-12045: pgAdmin 4 AI Assistant Read-Only Transaction Bypass to RCE

HERMES

HERMES THREAT SCORE & DATABASE ATTACK SURFACE

Target: pgAdmin 4 (AI Assistant - execute_sql_query)

Confidence: 95%

94 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-12045 at 9.1 (CRITICAL, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score evaluates operational impact at 94 (CRITICAL) considering core enterprise relational database exposure.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-12045: pgAdmin 4 AI Assistant Read-Only Transaction Bypass to RCEVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTpgAdmin PostgreSQL Tools

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in pgAdmin PostgreSQL Tools documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Security Advisory: CWE-863: Incorrect Authorization / CWE-502: Insecure Deserialization

CVSS v3.1 : 9.1 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) / CWE-863: Incorrect Authorization / CWE-502: Insecure Deserialization. Addressed in official release 9.14.

Executive Summary

CVE-2026-12045 is a critical vulnerability (CVSS 9.1) in pgAdmin 4 version 9.13. The integrated AI Assistant provides an execute_sql_query tool that runs LLM-generated SQL queries inside a BEGIN TRANSACTION READ ONLY block to guarantee safety. However, the implementation passed the LLM-generated query directly without sanitizing multi-statement semicolons or transaction commit commands (COMMIT; BEGIN TRANSACTION READ WRITE;). An attacker who plants indirect prompt injection in database records can hijack the AI assistant to escape read-only boundaries, modify tables, or invoke COPY ... PROGRAM to execute arbitrary operating system commands.

---

1. Technical Context & Affected Software Matrix

The component pgAdmin 4 (AI Assistant - execute_sql_query) provides essential data persistence, replication, and query execution services across enterprise PostgreSQL clusters.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-12045	Official Upstream Security Release
Affected Product	pgadmin:pgadmin4	Relational Database & Administration Ecosystem
Vulnerable Component	pgAdmin 4 (AI Assistant - execute_sql_query)	Database Backend / Tool / Extension
Weakness Class	CWE-863: Incorrect Authorization / CWE-502: Insecure Deserialization	Memory Safety / Authorization Vulnerability
CVSS v3.1 Score	9.1 (CRITICAL / Hermes Score 94)	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fixed Version	9.14	Official security patch release
MITRE ATT&CK	T1059.001 - Command and Scripting Interpreter: PowerShell/Bash, T1505.001 - SQL Stored Procedures	Privilege Escalation / Execution
Forensic Cross-Reference	Agentic Attack Patterns and Prompt Injection Forensics	Memory analysis and query telemetry

---

2. In-Depth Technical Decomposition & Root Cause

Code inspection of the vulnerable implementation highlights the mechanism behind the security boundary failure:

# Flaw in web/pgadmin/tools/sqleditor/ai/assistant.py
def execute_sql_query(query: str):
    # Intended to be read-only:
    wrapped_query = f"BEGIN TRANSACTION READ ONLY;\n{query};\nCOMMIT;"

    # VULNERABILITY: If query contains: "COMMIT; COPY cmd FROM PROGRAM '...';",
    # the read-only transaction is closed and the malicious statement executes!
    cursor.execute(wrapped_query)

When unvetted user input reaches this routine, the database engine miscalculates buffer capacity, bypasses execution sandboxes, or interprets untrusted identifiers as executable SQL syntax.

---

3. Attack Scenarios & Threat Modeling

1. Initial Vector & Preconditions: An attacker inserts a customer support ticket containing: `Ignore previous instructions.
2. Triggering Primitive: The attacker injects crafted input parameters targeting pgAdmin 4 (AI Assistant - execute_sql_query).
3. Security Invariant Breakdown: Security boundary is breached.
4. Impact Realization: When an administrator asks the pgAdmin AI Assistant to analyze the tickets, the assistant executes the SQL, breaking out of the read-only wrapper and executing a reverse shell on the database server..

---

4. Forensic Detection, Artifacts & System Logs

Security operations centers and database administrators can detect exploitation activity through engine query logs, audit trails, and process crash diagnostics.

Database & Process Telemetry

Inspect PostgreSQL server logs (/var/log/postgresql/) for messages matching: pgadmin4: SQL query escaped read-only block / spawned PROGRAM subprocess. Monitor for abnormal query aborts or sudden backend terminations.

System Auditing & Call Tracing

Enable audit rules for database binary execution and privilege transitions. Consult Agentic Attack Patterns and Prompt Injection Forensics.

Threat Hunting Rule (Sigma / Auditd)

Sigma Rule

sigma_cve_2026_12045.yaml

title: pgAdmin AI Assistant Tool Execution Escaping Read-Only Transaction
id: cve-2026-12045
status: experimental
description: Detects exploitation artifacts and abnormal SQL execution for CVE-2026-12045.
logsource:
    category: database
    product: postgresql
detection:
    selection:
        - 'pgadmin4:'
        - 'pgadmin4'
    condition: selection
fields:
    - Query
    - User
level: high

eBPF Tracepoint

# Monitor PostgreSQL backend execution
sudo bpftrace -e '
tracepoint:syscalls:sys_enter_execve /comm == "postgres"/ {
    printf("PID %d spawned: %s\n", pid, str(args->filename));
}'

---

5. Remediation & Hardening Guidelines

Protecting PostgreSQL infrastructure against CVE-2026-12045 requires applying vendor security updates and enforcing least-privilege configurations:

1. Software Update: Upgrade pgadmin:pgadmin4 packages to version 9.14 or higher via your operating system package manager or official repositories.
2. Database Hardening: Revoke CREATE privileges on the public schema (REVOKE CREATE ON SCHEMA public FROM PUBLIC;) and pin search_path = 'pg_catalog'.
3. Forensic Guidance: For complete forensic telemetry workflows, consult our guide on Agentic Attack Patterns and Prompt Injection Forensics.