SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host. Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter. This issue affects pgAdmin 4: before 9.15.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1545df20ad advisory.

    Update to pgadmin4-9.15.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-68f6155fea advisory.

    Update to pgadmin4-9.15.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields
    (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly
    into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with
    the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the
    connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to
    operating-system command execution on the database host. Fix introduces server-side allow-listing of all
    four fields and switches reindex_tablespace from manual quoting to the qtIdent filter. This issue affects
    pgAdmin 4: before 9.15. (CVE-2026-7815)

ID	Name	Product	Family	Severity
315979	Fedora 43 : pgadmin4 (2026-1545df20ad)	Nessus	Fedora Local Security Checks	critical
315975	Fedora 44 : pgadmin4 (2026-68f6155fea)	Nessus	Fedora Local Security Checks	critical
442103	SCA: security update for pgadmin4 (GHSA-hp84-p2gq-6fvr)	Tenable Cloud Security	SCA Checks	high
442103	SCA: security update for pgadmin4 (GHSA-hp84-p2gq-6fvr)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-7815

high

Tenable Plugins

critical

critical

high

high