Is CVE-2024-4215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-4215 being exploited in the wild.

How severe is CVE-2024-4215?

Low severity, with a CVSS score of 3.1, published 7 July 2026.

Which products and versions are affected?

pgAdmin 4.0 through 8.5; pgadmin4 (PyPI) ECOSYSTEM:introduced=0,fixed=8.6.

Is there a fix for CVE-2024-4215?

Yes. pgadmin4 (PyPI): upgrade to 8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-4215 attacked?

It is attacked over the network.

Am I affected by CVE-2024-4215?

Check whether you run pgAdmin or pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-4215: PYSEC-2026-1768 - pgAdmin is affected by a multi-factor authentication bypass vulnerability

CVE-2024-4215 · Severity: low · CVSS 3.1 · Published 2026-07-07

pgAdmin is a web-based administration tool for PostgreSQL databases used by database teams to manage databases, execute queries, and maintain database infrastructure. An attacker with a legitimate user's username and password can bypass the account's multi-factor authentication (MFA) protection to log in and perform sensitive actions such as managing files and executing SQL queries, undermining a key security control designed to protect database environments.

Technologies: pgadmin4 (PyPI). Vendors: pgAdmin, PyPI.

Quick answers

Is CVE-2024-4215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-4215 being exploited in the wild.
How severe is CVE-2024-4215?: Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?: pgAdmin 4.0 through 8.5; pgadmin4 (PyPI) ECOSYSTEM:introduced=0,fixed=8.6.
Is there a fix for CVE-2024-4215?: Yes. pgadmin4 (PyPI): upgrade to 8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-4215 attacked?: It is attacked over the network.
Am I affected by CVE-2024-4215?: Check whether you run pgAdmin or pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pgadmin4 (PyPI): upgrade to 8.6 or later
```
pip install "pgadmin4>=8.6"
```

Technical details

pgAdmin versions 8.5 and earlier contain an authentication bypass vulnerability in the MFA implementation (CWE-89 related to improper input validation in authentication logic). An attacker with valid credentials can authenticate to the application without satisfying MFA requirements, allowing full access to protected database operations. The vulnerability requires knowledge of a legitimate account's username and password (valid credentials are a precondition); network access to pgAdmin is required. The fix was released in version 8.6, and patch commits are available in the project repository.

Affected products

pgAdmin pgAdmin 4.0 through 8.5

Identifiers

CVE-2024-4215
GHSA-2mvc-557g-5638
PYSEC-2026-1768

Timeline

2024-05-02: disclosed: Vulnerability published to OSV
2024: patched: Fix released in pgAdmin 8.6

References

https://github.com/pgadmin-org/pgadmin4/issues/7425

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.