pgAdmin Read-Only Checks Fail Open in AI Assistant
pgAdmin 4 < 9.18 can let an authenticated user push SQL through the AI Assistant even when read-only mode is supposed to block writes. The break is a parser mismatch: pgAdmin validates the query one way, then PostgreSQL can execute the same text with different meaning, so a fix can look complete and still leave data changes open.
CSIRT-ITA flags CVE-2026-17351 as a critical SQL injection with a public PoC. It traces back to an incomplete fix for CVE-2026-12045 and affects the AI Assistant execute_sql_query tool; in some conditions it can also reopen arbitrary code execution risk. pgAdmin 4 9.18 is the fixed release.