Bug 2563934 (CVE-2026-119426)

Summary: CVE-2026-119426 phpMyAdmin: phpMyAdmin: Arbitrary SQL execution via CSRF token bypass
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in phpMyAdmin. A remote attacker can execute arbitrary database queries by bypassing cross-site request forgery (CSRF) token validation on standard HTTP POST requests. By tricking an authenticated user into submitting a crafted cross-site request, an attacker can execute SQL commands with the privileges of the victim's database account.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565559, 2565560, 2565561, 2565562, 2565564    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-30 11:45:23 UTC 
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.