Product by Open Source
Pgadmin 4
42 known vulnerabilities in Pgadmin 4 (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
42
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
10
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-7816 | pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout | 8.8 | |
| Critical | CVE-2026-12046 | Pgadmin.org pgAdmin 4: Missing Authentication for Critical Function | 9.0 | |
| Critical | CVE-2026-86863 | Pgadmin.org pgAdmin 4: Authentication Bypass by Spoofing | 9.8 | |
| Critical | CVE-2026-17566 | Pgadmin.org pgAdmin 4: OS Command Injection | 9.9 | |
| High | CVE-2026-86864 | pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool | 8.8 | |
| High | CVE-2026-17347 | pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution | 8.8 | |
| Critical | CVE-2026-12045 | Pgadmin.org pgAdmin 4: SQL Injection | 8.8 | |
| High | CVE-2026-12044 | Pgadmin.org pgAdmin 4: SQL Injection | 8.8 | |
| High | CVE-2026-17346 | Pgadmin.org pgAdmin 4: SQL Injection | 8.8 | |
| Critical | CVE-2026-17351 | Pgadmin.org pgAdmin 4: SQL Injection | 9.0 | |
| Critical | CVE-2026-116241 | Pgadmin.org pgAdmin 4: OS Command Injection | 9.9 | |
| Critical | CVE-2026-7813 | pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode | 9.9 | |
| Critical | CVE-2026-17349 | Pgadmin.org pgAdmin 4: Authorization Bypass Through User-Controlled Key | 9.6 | |
| Critical | CVE-2026-116238 | Pgadmin.org pgAdmin 4: Improper Restriction of Excessive Authentication Attempts | 8.1 | |
| High | CVE-2026-116239 | pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username | 8.5 | |
| High | CVE-2026-12050 | pgAdmin 4: SQL injection in named restore point endpoint | 8.8 | |
| High | CVE-2026-7815 | pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution | 8.8 | |
| High | CVE-2026-1707 | Restore restriction bypass via key disclosure vulnerability (pgAdmin 4) | 7.4 | |
| High | CVE-2026-116249 | pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory | 8.4 | |
| High | CVE-2026-116247 | pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate | 8.2 | |
| High | CVE-2026-116245 | pgAdmin 4: Connection services are not restricted in server mode | 8.2 | |
| High | CVE-2026-116244 | pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials | 8.2 | |
| High | CVE-2026-116242 | pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity | 8.2 | |
| High | CVE-2026-86862 | pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools | 6.5 | |
| High | CVE-2026-116243 | pgAdmin 4: Utility binary path can point at a shared storage directory | 7.5 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 30sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 25sans-atrisk-mail,