CVE-2026-17566
pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
Description
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \copy tokenizer treats \ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\') TO PROGRAM 'echo pwned' x' was therefore accepted as "balanced" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \copy (...) subquery, exposing an attacker-chosen TO PROGRAM '<command>' clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor). The fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \ depends on the target server's standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing. This issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18.
INFO
Published Date :
July 31, 2026, 4:17 p.m.
Last Modified :
Oct. 23, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE | ||||
| CVSS 4.0 | CRITICAL | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | ||||
| CVSS 4.0 | CRITICAL | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 |
Solution
- Update pgAdmin 4 to the latest version.
- Avoid backslashes within single-quoted strings in queries.
- Apply vendor security patches when available.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-17566.
| URL | Resource |
|---|---|
| https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3 | Patch |
| https://github.com/pgadmin-org/pgadmin4/issues/10213 | Issue Tracking Patch |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-17566 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-17566
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-17566 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-17566 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: pgAdmin 4 de pgadmin.org, Description: La herramienta de Importación/Exportación de Datos de pgAdmin 4 construye una línea de comando psql \copy (...) interpolando una consulta SQL proporcionada por el usuario en una plantilla Jinja y pasando la línea renderizada a psql a través de --command. Para evitar que un atacante escape del envoltorio (...), create_import_export_job() (ruta POST /import_export/job/[sid], protegida solo por el permiso ordinario y comúnmente otorgado tools_import_export_data) validaba la consulta con un verificador de balance de paréntesis escrito a mano, _is_query_parens_balanced(). Ese verificador siempre trataba una barra invertida antes de una comilla simple (\’) como escape de la comilla, es decir, como si standard_conforming_strings estuviera desactivado. PostgreSQL ha establecido standard_conforming_strings en activado por defecto desde la versión 9.1 (2010), el valor por defecto en cada versión de PostgreSQL que pgAdmin 4 soporta actualmente (13-18); bajo ese valor por defecto, el propio tokenizador \copy de psql trata \ como un carácter ordinario, por lo que una comilla simple inmediatamente después cierra el literal de cadena. Una consulta como SELECT ’a\’) TO PROGRAM ’echo pwned’ x’ fue por lo tanto aceptada como “balanceada” por el verificador de pgAdmin (que creía que el ) todavía estaba dentro de la cadena), mientras que psql, ejecutado a través de la línea de comando renderizada real, cierra la cadena en ese punto y trata el siguiente ) como el final de la subconsulta \copy (...) envolvente, exponiendo una cláusula TO PROGRAM ’[command]’ elegida por el atacante que psql ejecuta a través de popen() -- independientemente de un error de sintaxis posterior más adelante en la misma línea. Esta es la misma clase de error que CVE-2025-12762/CVE-2025-13780 (RCE a través de inyección de meta-comando psql/COPY durante la restauración de volcado en formato PLAIN), alcanzado a través de una defensa escrita independientemente en un módulo diferente (Importación/Exportación de Datos en lugar de Restauración) que tenía su propio y diferente error lógico (semántica de escape de barra invertida invertida en lugar de un ancla de regex derrotada por BOM). La solución rechaza directamente cualquier barra invertida dentro de una cadena entre comillas simples en la consulta, en lugar de elegir una de las dos posibles interpretaciones de psql. Esto es intencionalmente conservador: porque la interpretación correcta de \ depende de la configuración standard_conforming_strings del servidor de destino, que el verificador no puede conocer de forma fiable en el momento de la validación, rechazar la consulta es más seguro que adivinar. Este problema afecta a pgAdmin 4: desde la introducción de _is_query_parens_balanced() antes de la versión 9.18. -
Initial Analysis by [email protected]
Aug. 05, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* versions up to (excluding) 9.18 Added Reference Type PostgreSQL: https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3 Types: Patch Added Reference Type PostgreSQL: https://github.com/pgadmin-org/pgadmin4/issues/10213 Types: Issue Tracking, Patch -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 01, 2026
Action Type Old Value New Value Changed SSVC {'id': 'CVE-2026-17566', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-31T16:58:55.142206Z'} {'id': 'CVE-2026-17566', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-31T00:00:00+00:00'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 31, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-17566', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-31T16:58:55.142206Z'} -
New CVE Received by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Jul. 31, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/pgadmin-org/pgadmin4', 'vendor': 'pgadmin.org', 'modules': ['Import/Export Data'], 'product': 'pgAdmin 4', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '9.18', 'versionType': 'custom'}], 'programFiles': ['https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/import_export/__init__.py'], 'defaultStatus': 'unaffected'}] Added Description pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \copy tokenizer treats \ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\') TO PROGRAM 'echo pwned' x' was therefore accepted as "balanced" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \copy (...) subquery, exposing an attacker-chosen TO PROGRAM '<command>' clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor). The fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \ depends on the target server's standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing. This issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-78 Added CWE CWE-115 Added Reference https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3 Added Reference https://github.com/pgadmin-org/pgadmin4/issues/10213