Loading vulnerability…
CVE-2026-17351 is a critical SQL injection and security restriction bypass vulnerability in pgAdmin 4's AI Assistant execute_sql_query tool. The flaw is an incomplete fix for CVE-2026-12045 and affects versions 9.13 through 9.16. The vulnerable logic validates LLM-supplied SQL with sqlparse, requiring it to appear as exactly one non-transaction-control statement before executing it inside a read-only transaction wrapper. Because sqlparse's string-literal lexing can disagree with PostgreSQL's own parser when standard_conforming_strings is enabled, specially crafted input can be classified as a single harmless statement by the validator while PostgreSQL interprets and executes it as multiple statements. This allows an injected transaction-control statement to terminate the intended read-only wrapper, after which attacker-controlled SQL can execute with write semantics. The issue is reachable through indirect prompt injection, where attacker-controlled content read by the AI Assistant causes the model to emit a malicious tool call. An attempted fix using psycopg3 prepared execution was ineffective under pgAdmin's default configuration because prepare_threshold remained unset, allowing fallback to the simple query protocol. The corrected fix forces the dedicated read-only connection to use the extended query protocol so PostgreSQL rejects multi-statement input.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python proof-of-concept for authenticated remote code execution against pgAdmin 4 via CVE-2026-17566. The repo contains three files: an MIT LICENSE, a README describing the vulnerability and usage, and a single executable Python script, pgadmin4_rce_poc.py, which is the clear entry point. The exploit is not part of a larger framework. It uses Python standard-library networking only: urllib for HTTP(S), cookiejar for session handling, ssl for optional certificate verification bypass, regex for CSRF token extraction, and json for request construction. The script implements a complete attack flow: authenticate to pgAdmin, retrieve a CSRF token from GET /login, submit credentials to POST /login, enumerate accessible server objects via GET /browser/servers, then send a crafted JSON request to POST /import_export/job/<sid>. Its core capability is command execution on the host running pgAdmin. The malicious query is built by build_query(), which returns a payload of the form SELECT 'a\') TO PROGRAM '%s' x'. This is designed to exploit a parsing mismatch between pgAdmin's parenthesis checker and psql string handling, causing the injected TO PROGRAM clause to become active. The operator can supply an arbitrary command with --command or request an automatically generated bash reverse shell with --reverse HOST:PORT. Default demonstration behavior writes command output to /tmp/pgadmin_rce_proof, and the export job uses /tmp/pgadmin_export.csv as the nominal output file. Operationally, this is more than a detector: it performs authentication, target enumeration, payload generation, and exploit delivery. However, it is still a PoC-style standalone script rather than a weaponized framework module. The README also notes the code was based on public analysis and may require minor field adjustments depending on exact pgAdmin version behavior.
This repository is a compact Python PoC for CVE-2026-17351 affecting pgAdmin 4 AI Assistant. It contains two executable scripts and a README. The main exploit logic is in poc.py, which reproduces pgAdmin 9.16-style sqlparse-based read-only validation, then shows that the crafted SQL payload is classified as a single safe SELECT by sqlparse but is executed by PostgreSQL simple query protocol as multiple statements. The payload issues COMMIT to escape BEGIN TRANSACTION READ ONLY and then performs CREATE TABLE pwn(x int), proving write access. The script also demonstrates the mitigation by forcing psycopg3 extended query protocol with prepare_threshold=0 and prepare=True, which causes PostgreSQL to reject the multi-statement text structurally. The second script, prompt_injection_demo.py, models the delivery chain through indirect prompt injection. It stores attacker-controlled text in a column comment on customers.email, reads that comment back, simulates an LLM extracting the embedded SQL and emitting an execute_sql_query-style tool call, then executes the extracted query against PostgreSQL. This demonstrates that the exploit is not just raw SQL injection from direct user input, but a trust-boundary failure where untrusted database content can influence AI-generated tool calls. Repository structure is straightforward: README.md explains the vulnerability, payload, setup, and fix; poc.py is the primary exploit demonstration; prompt_injection_demo.py is a scenario-focused delivery demo. The exploit is real and operational, not merely a detector. It targets pgAdmin 4 versions 9.13 through 9.16 under the documented conditions and requires access to a PostgreSQL instance plus a vulnerable execution path in the AI Assistant.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical pgAdmin vulnerability caused by a discrepancy between the query validation parser and PostgreSQL's execution parser, allowing an authenticated remote attacker to bypass read-only restrictions, execute unauthorized SQL statements, manipulate database data, and potentially reintroduce arbitrary code execution scenarios.
A critical SQL injection vulnerability in pgAdmin 4's AI Assistant execute_sql_query tool caused by an incomplete fix for CVE-2026-12045 and a parser mismatch between sqlparse validation and PostgreSQL execution, allowing an authenticated remote attacker to bypass read-only restrictions, execute unauthorized SQL, modify data, and potentially reintroduce arbitrary code execution scenarios.
A pgAdmin 4 vulnerability in the AI Assistant execute_sql_query tool where sqlparse misclassifies a crafted multi-statement payload as a single statement, allowing PostgreSQL to execute multiple commands, break out of the intended read-only transaction, and re-enable write/RCE bypass. A proposed fix using psycopg prepare=True was ineffective under default configuration; the corrected fix forces extended query protocol by setting conn.prepare_threshold = 0.
A critical pgAdmin 4 vulnerability in the AI Assistant query execution path where sqlparse and PostgreSQL parse the same input differently, allowing a malicious LLM-supplied query to bypass the intended read-only transaction wrapper and re-enable write/RCE impact via indirect prompt injection.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.