SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint. The injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate. Fix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string. This issue affects pgAdmin 4: from 1.0 before 9.16.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c248414214 advisory.

    Update to pgadmin-9.16.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5938be3b09 advisory.

    Update to pgadmin-9.16.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of pgAdmin installed on the remote host is prior to 9.16. It is, therefore, affected by multiple SQL injection vulnerabilities:

  - Multiple SQL template sites across domain, domain-constraint, foreign-table, language,     event-trigger, and view dialogs render user-supplied description/comment text inside a Jinja     pattern via string interpolation instead of the qtLiteral escape filter. An authenticated user     can break out of the string literal and execute arbitrary SQL as the connected database role.
    (CVE-2026-12044)

  - The restore_point endpoint passes the user-supplied restore-point name directly into a SQL     query via str.format() instead of using a bound parameter. An authenticated user can inject     arbitrary SQL that runs as the connected database role. (CVE-2026-12050)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
323280	Fedora 44 : pgadmin4 (2026-c248414214)	Nessus	Fedora Local Security Checks	critical
323274	Fedora 43 : pgadmin4 (2026-5938be3b09)	Nessus	Fedora Local Security Checks	critical
322420	pgAdmin < 9.16 Multiple SQL Injections	Nessus	Databases	high

Detections

Analytics

CVE-2026-12050

medium

Tenable Plugins

critical

critical

high