Loading vulnerability…
CVE-2026-12045 is a critical vulnerability in pgAdmin 4's AI Assistant feature affecting versions 9.13 before 9.16. The flaw is in the execute_sql_query tool, which attempted to safely run LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper. The implementation forwarded the model-generated SQL to PostgreSQL without enforcing that it be limited to a single statement or to read-only statement types. As a result, a crafted multi-statement payload beginning with transaction-control commands such as COMMIT, END, ROLLBACK, or ABORT could terminate the read-only transaction and cause subsequent statements to execute in autocommit mode. The final rollback issued by the wrapper then became ineffective. Exploitation is delivered through prompt injection: an attacker who can influence database content inspected by the assistant, such as stored rows, column values, or comments, can induce the model to emit a malicious tool call. Successful exploitation allows arbitrary SQL execution with the privileges of the pgAdmin user's database role, and can extend to operating-system command execution on the database server host through PostgreSQL server-program execution features when highly privileged roles are used.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a compact Python PoC for CVE-2026-17351 affecting pgAdmin 4 AI Assistant. It contains two executable scripts and a README. The main exploit logic is in poc.py, which reproduces pgAdmin 9.16-style sqlparse-based read-only validation, then shows that the crafted SQL payload is classified as a single safe SELECT by sqlparse but is executed by PostgreSQL simple query protocol as multiple statements. The payload issues COMMIT to escape BEGIN TRANSACTION READ ONLY and then performs CREATE TABLE pwn(x int), proving write access. The script also demonstrates the mitigation by forcing psycopg3 extended query protocol with prepare_threshold=0 and prepare=True, which causes PostgreSQL to reject the multi-statement text structurally. The second script, prompt_injection_demo.py, models the delivery chain through indirect prompt injection. It stores attacker-controlled text in a column comment on customers.email, reads that comment back, simulates an LLM extracting the embedded SQL and emitting an execute_sql_query-style tool call, then executes the extracted query against PostgreSQL. This demonstrates that the exploit is not just raw SQL injection from direct user input, but a trust-boundary failure where untrusted database content can influence AI-generated tool calls. Repository structure is straightforward: README.md explains the vulnerability, payload, setup, and fix; poc.py is the primary exploit demonstration; prompt_injection_demo.py is a scenario-focused delivery demo. The exploit is real and operational, not merely a detector. It targets pgAdmin 4 versions 9.13 through 9.16 under the documented conditions and requires access to a PostgreSQL instance plus a vulnerable execution path in the AI Assistant.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An earlier pgAdmin vulnerability whose incomplete fix led to CVE-2026-17351.
An earlier pgAdmin 4 AI Assistant SQL execution vulnerability whose fix is being discussed because the newly described issue reintroduces the same write/RCE bypass it was meant to close.
An earlier pgAdmin 4 vulnerability whose fix was incomplete, leading to the newly assigned bypass vulnerability CVE-2026-17351.
A vulnerability in pgAdmin 4's AI Assistant feature that allows bypass of read-only transaction restrictions and could potentially lead to remote code execution via PostgreSQL COPY TO PROGRAM when elevated privileges are available.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.