Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect. Delivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user's role the attacker can perform unauthorised data modification. When the pgAdmin user's role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM. Fix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, CALL, COPY, DO, SET/RESET, and everything else are rejected before any database work happens. PostgreSQL's READ ONLY mode continues to backstop data-modifying CTEs, EXPLAIN ANALYZE on writes, and volatile side effects. This issue affects pgAdmin 4: from 9.13 before 9.16.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bacb14f76f advisory.

    Update to pgadmin-9.17.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f0550055a7 advisory.

    Update to pgadmin-9.17.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c248414214 advisory.

    Update to pgadmin-9.16.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5938be3b09 advisory.

    Update to pgadmin-9.16.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of pgAdmin installed on the remote host is 9.x prior to 9.16. It is, therefore, affected by a read-only transaction bypass vulnerability:

  - The AI Assistant's execute_sql_query tool accepts multi-statement payloads. A single     COMMIT followed by a write-statement terminates the enclosing BEGIN TRANSACTION READ ONLY     wrapper and runs subsequent statements in autocommit mode. On a superuser-connected session     this chains to operating-system command execution on the database host. (CVE-2026-12045)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
333549	Fedora 43 : pgadmin4 (2026-bacb14f76f)	Nessus	Fedora Local Security Checks	Local	critical
333541	Fedora 44 : pgadmin4 (2026-f0550055a7)	Nessus	Fedora Local Security Checks	Local	critical
323280	Fedora 44 : pgadmin4 (2026-c248414214)	Nessus	Fedora Local Security Checks	Local	critical
323274	Fedora 43 : pgadmin4 (2026-5938be3b09)	Nessus	Fedora Local Security Checks	Local	critical
322418	pgAdmin 9.x < 9.16 Read-Only Transaction Bypass (CVE-2026-12045)	Nessus	Databases	Local	critical

Detections

Analytics

CVE-2026-12045

critical

Tenable Plugins

critical

critical

critical

critical

critical