CVE-2026-116241
8.8, highPgadmin.org pgAdmin 4 OS Command Injection Vulnerability
- CVSS
- 8.8, high high CVSS v3.1
- EPSS, next 30 days
- 0.3% higher than 25.5% of scored CVEs
- Exploitation
- No public evidence
- Published
- 30 Oct 20266 days ago
Description
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, where it treated the next double quote as closing the identifier. psql's \copy parser applies the connection's escape character to whichever quote opened a token, so with standard_conforming_strings off a backslash-escaped double quote does not close the identifier. pgAdmin's and psql's view of the quoting then diverged, a closing parenthesis hidden from the check ended the \copy (...) wrapper, and a following TO PROGRAM clause was executed by psql on the pgAdmin host, as the operating-system account running pgAdmin, before the server rejected the statement. An ordinary database role can turn standard_conforming_strings off for itself, and the Import/Export Data permission is granted to non-administrators by default. This is a bypass of the fix for CVE-2026-17566. The fix rejects any backslash inside a double-quoted identifier, as was already done for single-quoted strings, since its meaning depends on a server setting that cannot be known reliably when the query is validated. This issue affects pgAdmin 4: before 9.19.
Details
- Vendor
- Pgadmin.org
- Product
- pgAdmin 4
- Weakness
- CWE-78 (opens in a new tab)
- Status
- Analyzed
- Updated
- 4 Nov 2026
- Assigner
- f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References 2
Patches and fixes 1
Other references 1
The kind is read from NVD's tags where present and from the shape of the URL otherwise, so treat it as a hint.
Other Pgadmin.org CVEs
Every Pgadmin.org CVE we holdSame vendor in what we hold, not a known link between the flaws.
- CVE-2026-116242 Pgadmin.org pgAdmin 4 Insufficiently Protected Credentials Vulnerability EPSS 0.2% 9.6, critical
- CVE-2026-116244 Pgadmin.org pgAdmin 4 Insufficiently Protected Credentials Vulnerability EPSS 0.3% 9.6, critical
- CVE-2026-116245 Pgadmin.org pgAdmin 4 Insufficiently Protected Credentials Vulnerability EPSS 0.2% 9.6, critical
- CVE-2026-116247 Pgadmin.org pgAdmin 4 Insufficiently Protected Credentials Vulnerability EPSS 0.1% 9.6, critical
- CVE-2026-116239 Pgadmin.org pgAdmin 4 Improper Authentication Vulnerability EPSS 0.4% 8.8, high
- CVE-2026-116243 Pgadmin.org pgAdmin 4 Untrusted Search Path Vulnerability EPSS 0.3% 8.8, high
- CVE-2026-116246 To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into… EPSS 0.2% 7.6, high
Beyond this page
Is CVE-2026-116241 in your network?
This page tells you how dangerous CVE-2026-116241 is out there. Whether it sits on one of your devices, only a scan of your own network can tell. That is what our systems do, every day, for the companies we protect.
-
EXYS7600 OCELOT
Find it before attackers do
Ocelot scans your network on a schedule and reports every vulnerability it finds by its CVE identifier, with its CVSS score and how many of your hosts are affected. A finding like CVE-2026-116241 comes with the devices to patch.
Learn more about EXYS7600 OCELOT -
EXYS7950 KONDRA
Detect it if it's exploited
Until the patch is applied, Kondra monitors your network, events and endpoints in real time. It keeps an inventory of the software installed on every endpoint, and its anomaly detection rules flag what an attacker does once inside.
Learn more about EXYS7950 KONDRA
Assembled from the NVD 2.0 API, the CISA Known Exploited Vulnerabilities Catalog and FIRST EPSS. Scores are as of our last collection on 5 Nov 2026, not the live upstream state.