Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-12046
By Roy Kalfon |
19 June 2026
pgAdmin 4 SQL Editor endpoints missing auth reach unsafe pickle deserialization sink
[Under Evaluation – CVE-2026-12046]: In pgAdmin 4 (server mode) DELETE /sqleditor/close/ and POST /sqleditor/initialize/sqleditor/update_connection/// lack @pga_login_required and can reach pickle.loads on session gridData command objects. Affects 6.9 to `