pgadmin.org has 15 CVEs on record. Disclosure cadence is accelerating: 15 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 15. The median CVSS is 8.1 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-522 (5) and CWE-1188 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 15 prev 0
Weakness classes
Products
- pgAdmin 4 15
Worst active — by depth score
CVE-2026-116244High· 8.2pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials57CVE-2026-116241Critical· 9.9pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier55CVE-2026-116239High· 8.5pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username47CVE-2026-116249High· 8.4pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory46CVE-2026-116247High· 8.2pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate45
pgadmin.org vulnerabilities
CVEs affecting pgadmin.org, newest first. Open any entry for full detail, references, and exploit status.
15 CVEsRSS
CVE-2026-116251Medium· 4.2pgAdmin 4: A user's other sessions survive a change of their password
pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management. A session established before the chang…
CVE-2026-116252Medium· 6.5pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the…
CVE-2026-116249High· 8.4pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but get_complete_file_path() only stripped leading slashes before joining the tw…
CVE-2026-116250Medium· 6.5pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that ope…
CVE-2026-116241Critical· 9.9pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-…
CVE-2026-116248Medium· 6.8pgAdmin 4: Non-administrators can share a server with every user
In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the "shared" flag and sha…
CVE-2026-116247High· 8.2pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate
When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating…
CVE-2026-116246Medium· 6.5pgAdmin 4: Server passwords are left in pgAdmin's process environment
To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a …
CVE-2026-116243High· 7.5pgAdmin 4: Utility binary path can point at a shared storage directory
pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SH…
CVE-2026-116245High· 8.2pgAdmin 4: Connection services are not restricted in server mode
libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's…
CVE-2026-116244High· 8.2PoCpgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the oper…
CVE-2026-116242High· 8.2pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that a…
CVE-2026-116238High· 8.1pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal accoun…
CVE-2026-116240Medium· 6.5pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked
In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with get_abs_path(). Several callers then acted on a path they built differently, so the path chec…
CVE-2026-116239High· 8.5pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log i…