Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

pgAdmin 4 — Vulnerabilities & Security Advisories 42

All 42 CVE vulnerabilities found in pgAdmin 4, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses affecting pgAdmin 4, a web-based administration tool for PostgreSQL developed by the pgAdmin Development Team, specifically tagged with relevant vulnerability classifications. The collection encompasses a comprehensive range of issues including remote code execution, cross-site scripting, authentication bypasses, and information disclosure flaws identified in versions released over the past decade. Security professionals and system administrators can utilize this resource to track official advisories from the vendor, analyze the prevalence and impact of specific weakness classes within the application, or review the complete historical record of vulnerabilities associated with this product to assess their own deployment risks. By centralizing data from multiple sources, this aggregation provides a clear view of the security posture evolution for pgAdmin 4 without requiring users to search disparate databases or rely on fragmented reports. The information presented here supports proactive risk management, enabling organizations to prioritize patching efforts based on the severity and exploitability of reported defects. Regular updates ensure that the latest findings are included, facilitating timely response to emerging threats while maintaining a structured archive of past incidents for forensic analysis and compliance reporting purposes.

Vendor: pgAdmin Project

CVE ID Title CVSS Severity Published
CVE-2026-86864 pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool CWE-88 8.8 High 2026-09-17
CVE-2026-86863 pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode CWE-290 9.8 Critical 2026-09-17
CVE-2026-86862 pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools CWE-88 6.5 Medium 2026-09-17
CVE-2026-86861 pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check CWE-367 5.9 Medium 2026-09-17
CVE-2026-17566 pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780) CWE-78 9.9 Critical 2026-07-31
CVE-2026-17351 pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045) CWE-89 9.0 Critical 2026-07-31
CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers CWE-862 5.4 Medium 2026-07-31
CVE-2026-17349 pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner CWE-639 9.6 Critical 2026-07-31
CVE-2026-17348 pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046) CWE-306 6.5 Medium 2026-07-31
CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution CWE-78 7.5 High 2026-07-31
CVE-2026-17346 pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044) CWE-89 8.8 High 2026-07-31
CVE-2026-12049 pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter CWE-601 4.3 Medium 2026-06-18
CVE-2026-12048 pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser CWE-79 9.3 Critical 2026-06-18
CVE-2026-12047 pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text CWE-79 3.5 Low 2026-06-18
CVE-2026-12046 pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution CWE-306 9.0 Critical 2026-06-18
CVE-2026-12045 pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution CWE-89 9.0 Critical 2026-06-18
CVE-2026-12050 pgAdmin 4: SQL injection in named restore point endpoint CWE-89 4.3 Medium 2026-06-18
CVE-2026-12044 pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates CWE-89 8.8 High 2026-06-18
CVE-2026-7819 pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write 8.1 High 2026-05-11
CVE-2026-7820 pgAdmin 4: Account-lockout bypass via Flask-Security default /login view 6.5 Medium 2026-05-11
CVE-2026-7818 pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution 7.0 High 2026-05-11
CVE-2026-7816 pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout 8.8 High 2026-05-11
CVE-2026-7817 pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints 6.5 Medium 2026-05-11
CVE-2026-7815 pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution 8.8 High 2026-05-11
CVE-2026-7814 pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer 4.8 Medium 2026-05-11
CVE-2026-7813 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode 9.9 Critical 2026-05-11
CVE-2026-1707 Restore restriction bypass via key disclosure vulnerability (pgAdmin 4) 7.4 High 2026-02-05
CVE-2025-13780 Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) 9.1 Critical 2025-12-11
CVE-2025-12764 pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow. 7.5 High 2025-11-13
CVE-2025-12765 pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass. 7.5 High 2025-11-13

All 42 known CVE vulnerabilities affecting pgAdmin 4 with full Chinese analysis, references, and POCs where available.