What’s Vulnerable › Products
pgadmin.org pgAdmin 4 vulnerabilities
46 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 35 published in the last 12 months.
Check whether your pgadmin.org pgAdmin 4 version is affected
Latest pgadmin.org pgAdmin 4 vulnerabilities
- CVE-2026-86864 — pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool (CVSS 8.8)
- CVE-2026-86863 — pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode (CVSS 9.8)
- CVE-2026-86862 — pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools (CVSS 6.5)
- CVE-2026-86861 — pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check (CVSS 5.9)
- CVE-2026-17566 — pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780) (CVSS 9.9)
- CVE-2026-17351 — pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045) (CVSS 9.0)
- CVE-2026-17350 — pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers (CVSS 5.4)
- CVE-2026-17349 — pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner (CVSS 9.6)
- CVE-2026-17348 — pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046) (CVSS 6.5)
- CVE-2026-17347 — pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution (CVSS 8.8)
- CVE-2026-17346 — pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044) (CVSS 8.8)
- CVE-2026-12050 — pgAdmin 4: SQL injection in named restore point endpoint (CVSS 8.8)
- CVE-2026-12049 — pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter (CVSS 6.1)
- CVE-2026-12048 — pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser (CVSS 5.4)
- CVE-2026-12047 — pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text (CVSS 5.4)
- CVE-2026-12046 — pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution (CVSS 9.0)
- CVE-2026-12045 — pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution (CVSS 8.8)
- CVE-2026-12044 — pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates (CVSS 8.8)
- CVE-2026-7820 — pgAdmin 4: Account-lockout bypass via Flask-Security default /login view (CVSS 6.5)
- CVE-2026-7819 — pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write (CVSS 8.1)
- CVE-2026-7818 — pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution (CVSS 7.8)
- CVE-2026-7817 — pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints (CVSS 6.5)
- CVE-2026-7816 — pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout (CVSS 8.8)
- CVE-2026-7815 — pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution (CVSS 8.8)
- CVE-2026-7814 — pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer (CVSS 4.8)