pgAdmin < 9.16 Missing Authentication (CVE-2026-12046)

The version of pgAdmin installed on the remote host is prior to 9.16. It is, therefore, affected by a missing authentication vulnerability: - Two state-mutating SQL Editor endpoints are missing the pgaloginrequired decorator and are reachable without authentication in server mode. Both endpoints...

CVE-2026-12046 pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/ and POST /sqleditor/initialize/sqleditor/updateconnection/// -- were the only routes in the module missing the @pgaloginrequired decorator. Both reach a pickle.loads sink on session'gridData''commandobj':...