Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Unrated

Read-only transaction bypass in pgAdmin 4 AI Assistant

IdentifiersCVE-2026-12045CWE-89

CVE-2026-12045 is a critical vulnerability in the pgAdmin 4 AI Assistant affecting versions 9.13 through before 9.16. The flaw is in the assistant's execute_sql_query tool, which attempted to constrain LLM-generated SQL by wrapping it in BEGIN TRANSACTION READ ONLY. However, the implementation forwarded the LLM-supplied SQL to the database driver without enforcing that it be exactly one statement or that it begin with a read-only verb. As a result, a malicious multi-statement payload beginning with transaction-control statements such as COMMIT, END, ROLLBACK, or ABORT could terminate the read-only transaction and cause subsequent statements to execute in autocommit mode. The attack is delivered via prompt injection: if an attacker can place crafted content into database objects the AI Assistant may inspect, such as rows, column values, or comments, the LLM can be induced to emit the malicious SQL as a tool call. Successful exploitation allows arbitrary SQL execution with the privileges of the pgAdmin user's database role.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker to bypass the AI Assistant's intended read-only restriction and execute arbitrary SQL as the pgAdmin user's database role. With ordinary write privileges on that role, this can result in unauthorized data modification. If the pgAdmin user's role is a PostgreSQL superuser or has the pg_execute_server_program privilege, the impact can escalate to remote code execution on the PostgreSQL server host, for example via COPY ... TO PROGRAM. Depending on role privileges, this can also enable broader compromise of database integrity and server-side execution.

Mitigation

If you can’t patch tonight, do this now.

Until patched, disable or avoid use of the pgAdmin 4 AI Assistant against untrusted database content. Restrict who can write rows, comments, and column values that the assistant may inspect. Ensure the pgAdmin database role used by the assistant does not have superuser privileges and does not hold pg_execute_server_program. More generally, minimize database role privileges available to pgAdmin and avoid exposing the assistant to attacker-controlled prompt content.

Remediation

Patch, then assume compromise.

Upgrade pgAdmin 4 to version 9.16 or later. The fix validates LLM-supplied SQL before execution, requiring it to parse to exactly one non-empty, non-comment statement and allowing only statements whose leading real token is SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control statements, DML, DDL, CALL, COPY, DO, SET/RESET, and other unsafe statements are rejected before any database work occurs.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
PgadminPgadmin 4application

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5

Community discussion across Reddit, Mastodon, and other social sources.