pgAdmin 4 SQLi (CVE-2026-7815) Allows RCE on PostgreSQL Servers

The National Vulnerability Database has disclosed CVE-2026-7815, a critical SQL injection vulnerability in pgAdmin 4’s Maintenance Tool. This flaw stems from four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) being directly concatenated into VACUUM/ANALYZE/REINDEX commands. These commands are then passed to psql --command, creating a dangerous injection vector.

An authenticated user with tools_maintenance permissions can exploit this to break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. Crucially, the National Vulnerability Database notes that this injected SQL can further invoke COPY ... TO PROGRAM to achieve operating-system command execution on the database host, escalating the impact significantly. This is a full compromise chain from a privileged user to RCE.

pgAdmin 4 versions prior to 9.15 are affected. The fix involves server-side allow-listing for all four vulnerable fields and switching reindex_tablespace to use the qtIdent filter for proper quoting. With a CVSS score of 8.8 (HIGH), this isn’t theoretical; it’s a direct path to database and potentially server compromise.