The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several …

CVE-2026-17346 is a bypass of the incomplete fix introduced in CVE-2026-12044 for pgAdmin 4. The prior fix (v9.16) hardened qtLiteral for sixteen templates but missed several SQL template sinks that were incorrectly placed in an ALLOWLIST, assuming pg_catalog-sourced identifiers could never contain apostrophes. Since PostgreSQL allows arbitrary characters in quoted identifiers, a low-privileged user can create a table, publication, or subscription with an apostrophe in its name, breaking out of unescaped Jinja2 template interpolation. This allows arbitrary SQL injection in the session of any higher-privileged user who opens the affected Statistics or Dependencies tab. Affected sinks include Index Statistics (coll_stats.sql) and publication/subscription dependencies.sql and get_position.sql templates. The fix applies qtLiteral(conn) to all missed sinks and passes the connection object into render_template calls. Regression tests verify that apostrophe payloads are properly escaped and render as exactly one SQL statement. The Index Statistics sink has been vulnerable since pgAdmin 4 v1.0, and the Publications/Subscriptions sinks since v5.0, both remediated in v9.17.