{"basis":"claimed","id":"CVE-2026-12046","name":"pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution","vendorProject":"pgadmin.org","product":"pgAdmin 4","publishedAt":"2026-06-18","cvss":{"score":9.5,"severity":"CRITICAL","version":"4.0"},"exploited":null,"epss":{"score":0.01037,"percentile":0.63925,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2026-10-21","daysToRule":125},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution","description":"Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session['gridData'][<trans_id>]['command_obj']: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session.\n\nThe defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin's Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin's sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin.\n\nFix is a one-line @pga_login_required decorator on each of the two endpoints, matching the convention used by every other route in the module. The is_authenticated / MFA chain now runs before the trans_id is dereferenced, so an unauthenticated request is rejected before reaching the deserialization path.\n\nThe defect is server-mode only. In DESKTOP mode pgAdmin's before_request hook re-authenticates DESKTOP_USER on every request, so no endpoint can be exercised in an unauthenticated state and no auth decorator (or its absence) is meaningful. The accompanying regression test mirrors the attacker's path -- harvests an X-pgA-CSRFToken from GET /login and replays it against both endpoints -- and self-skips outside server mode for that reason; it is wired into the existing server-mode CI workflow alongside the data-isolation tests.\n\nThis issue affects pgAdmin 4: from 6.9 before 9.16.","cwes":["CWE-306","CWE-502"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2026-10-21","firstIsNew":true,"daysToRule":125,"daysAtMost":null,"freePlan":false,"claims":[{"id":"3e68a7b62205842612f339460e7235d2a229a3f2952d7890c66b8471c3396006","cve_id":"CVE-2026-12046","vendor":"f5","product":"Attack signatures","rule_id":"200013227","rule_name":"pgAdmin Authentication Bypass","change":"new","default_action":null,"published_on":"2026-10-21","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200013227 \"pgAdmin Authentication Bypass\" (Authentication/Authorization Attacks, risk Medium), systems: Other Web Server. References: CVE-2026-12046.","first_seen_at":"2026-11-02T21:00:23.656Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-03T18:25:15.821Z","cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"kevAction":null,"kevNotes":null,"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/10072","name":null,"tags":["issue-tracking"]},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/f81433ae2f998f95bb17f27f53b4e99ebcc1df9c","name":null,"tags":["patch"]}],"affected":[{"vendor":"pgadmin.org","product":"pgAdmin 4","affected":["6.9 to before 9.16"],"fixed":[]}],"briefing":{"status":{"id":"monitor","label":"Monitor"},"why":"It is reachable over the network without credentials or any user interaction (CVSS 9.5). Exploitation in the wild is not established by CISA KEV.","who":"Teams running pgadmin.org pgAdmin 4 (6.9 to before 9.16). Prioritise internet-facing instances.","what_to_do":[{"text":"Apply the vendor's fix; the advisory lists the affected and fixed versions.","href":"https://github.com/pgadmin-org/pgadmin4/commit/f81433ae2f998f95bb17f27f53b4e99ebcc1df9c","linkText":"github.com"},{"text":"Keep a WAF rule in place while you patch: F5 ships a rule you may need to switch on. A WAF rule reduces exposure; it does not replace the patch.","href":"#edge","linkText":"Edge coverage"},{"text":"Check which WAF sits in front of your site and whether it covers this CVE.","href":"#check","linkText":"Check your domain"}],"evidence":[{"heading":"CVE record","text":"CVSS 4.0 9.5 (critical). Weakness: CWE-306, CWE-502.","links":[{"label":"CVE-2026-12046","href":"https://www.cve.org/CVERecord?id=CVE-2026-12046"},{"label":"NVD","href":"https://nvd.nist.gov/vuln/detail/CVE-2026-12046"}]},{"heading":"Vendor advisory","text":"Fixes and mitigations the CVE record links to. Check affected builds against the vendor, including backports.","links":[{"label":"github.com","href":"https://github.com/pgadmin-org/pgadmin4/commit/f81433ae2f998f95bb17f27f53b4e99ebcc1df9c"}]},{"heading":"Exploit evidence","text":"No public exploit code found in Exploit-DB, Metasploit, nuclei-templates or GitHub. That does not mean none exists.","links":[]},{"heading":"CISA KEV","text":"Not in the KEV catalog (catalog 2026.11.03, checked 2026-11-04). Absence from KEV is not evidence that it cannot be exploited.","links":[{"label":"CISA KEV catalog","href":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}]},{"heading":"EPSS","text":"1.04% probability of exploitation activity in the next 30 days, higher than 63% of CVEs (2026-11-02).","links":[{"label":"FIRST EPSS","href":"https://api.first.org/data/v1/epss?cve=CVE-2026-12046"}]},{"heading":"WAF vendor statements","text":"F5 names it in a changelog. Quotes and dates below.","links":[{"label":"Vendor statements","href":"#evidence"}]}],"agent_prompt":"Assess whether the infrastructure available to you is affected by CVE-2026-12046 (pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution). Perform a read-only assessment within your authorized access. Do not send exploit traffic, scan third-party systems, change configuration or restart services.\n\n1. Verify the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-12046 and the vendor advisories (https://github.com/pgadmin-org/pgadmin4/commit/f81433ae2f998f95bb17f27f53b4e99ebcc1df9c). Establish affected and fixed versions, including vendor backports. The record lists: pgadmin.org pgAdmin 4: affected 6.9 to before 9.16. Cite sources and retrieval dates; flag anything you cannot verify.\n2. Inventory deployments of pgadmin.org pgAdmin 4: asset, environment, owner where known, installed version or build, and how you confirmed it (package metadata, a version endpoint, image tags). An image tag alone does not prove the running version.\n3. Identify which deployments are reachable from the internet or untrusted networks, and through which paths (direct origin, load balancer, CDN or WAF).\n4. Assess compensating controls separately from patch status. Current edge WAF coverage for this CVE: F5: rule exists, check whether it is enabled. Live data: https://cve.vigilbase.com/api/v1/cves/CVE-2026-12046. Check whether the rule is enabled and in block mode on each path, and whether any path bypasses the WAF. A WAF rule is not a patch.\n5. Check logs on exposed instances for requests matching the public exploit, if your access allows.\n\nReturn a short summary and a table: asset | version/build | assessment (affected, fixed, not applicable, unknown) | exposure | compensating control | evidence | next action. List what you could not assess and the access needed to resolve it. Do not infer absence of compromise from patch status or a lack of alerts.\n\nRemediation guidance: Apply the vendor's fix; the advisory lists the affected and fixed versions. Keep a WAF rule in place while you patch: F5 ships a rule you may need to switch on. A WAF rule reduces exposure; it does not replace the patch.\nMore: https://cve.vigilbase.com/cve/CVE-2026-12046"},"measured":[],"sightings":null,"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0},{"day":"2026-11-04","posts":0}],"top_posts":[],"exploit_repositories":[]}}