# PostgreSQL pgAdmin 4 vulnerabilities

Source: https://junglewise.ai/threats/technologies/pgadmin-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/pgadmin-4.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 26 vulnerabilities in PostgreSQL pgAdmin 4: 0 in the last 7 days and 4 in the last 90 days, 8 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86864, was published on 17 September 2026. Nothing in the last four weeks, down from 4 vulnerabilities in the four before. 0 critical against 1.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 4
- All time: 26 (8 critical, 0 exploited in the wild)

## About PostgreSQL pgAdmin 4

Web-based management and administration tool for PostgreSQL databases.

## Latest PostgreSQL pgAdmin 4 vulnerabilities

- [CVE-2026-86864: pgAdmin 4 Backup tool arbitrary file write and connection string injection](https://junglewise.ai/threats/cve-2026-86864-pgadmin-4-backup-tool-arbitrary-file-write-and-connection-string) (high, CVSS 8.8, published 17 Sep 2026)
- [CVE-2026-86863: pgAdmin 4 authentication bypass in webserver mode](https://junglewise.ai/threats/cve-2026-86863-pgadmin-4-authentication-bypass-in-webserver-mode) (critical, CVSS 9.8, published 17 Sep 2026)
- [CVE-2026-86862: pgAdmin 4 connection string injection in Restore and Maintenance tools](https://junglewise.ai/threats/cve-2026-86862-pgadmin-4-connection-string-injection-in-restore-and-maintenance) (medium, CVSS 6.5, published 17 Sep 2026)
- [CVE-2026-86861: pgAdmin 4 File Manager TOCTOU symlink write bypass in save_file](https://junglewise.ai/threats/cve-2026-86861-pgadmin-4-file-manager-toctou-symlink-write-bypass-in-save-file) (medium, CVSS 5.9, published 17 Sep 2026)
- [CVE-2026-17566: pgAdmin 4 OS command injection in Import/Export Data tool](https://junglewise.ai/threats/cve-2026-17566-pgadmin-4-os-command-injection-in-import-export-data-tool) (critical, CVSS 9.9, published 31 Jul 2026)
- [CVE-2026-17351: pgAdmin 4 SQL injection bypass in AI Assistant](https://junglewise.ai/threats/cve-2026-17351-pgadmin-4-sql-injection-bypass-in-ai-assistant) (critical, CVSS 9, published 31 Jul 2026)
- [CVE-2026-17350: PostgreSQL pgAdmin 4 missing authorization in per-tool permissions](https://junglewise.ai/threats/cve-2026-17350-postgresql-pgadmin-4-missing-authorization-in-per-tool) (medium, CVSS 5.4, published 31 Jul 2026)
- [CVE-2026-17349: PostgreSQL pgAdmin 4 credential leak in Workspaces adhoc connection](https://junglewise.ai/threats/cve-2026-17349-postgresql-pgadmin-4-credential-leak-in-workspaces-adhoc) (critical, CVSS 9.6, published 31 Jul 2026)
- [CVE-2026-17348: pgAdmin 4 missing authentication in multiple server-mode routes](https://junglewise.ai/threats/cve-2026-17348-pgadmin-4-missing-authentication-in-multiple-server-mode-routes) (medium, CVSS 6.5, published 31 Jul 2026)
- [CVE-2026-17347: pgAdmin 4 OS command injection in MASTER_PASSWORD_HOOK](https://junglewise.ai/threats/cve-2026-17347-pgadmin-4-os-command-injection-in-master-password-hook) (high, CVSS 7.5, published 31 Jul 2026)
- [CVE-2026-17346: pgAdmin 4 SQL injection in Statistics and Dependencies tabs](https://junglewise.ai/threats/cve-2026-17346-pgadmin-4-sql-injection-in-statistics-and-dependencies-tabs) (high, CVSS 8.8, published 31 Jul 2026)
- [CVE-2026-12050: pgAdmin 4 SQL injection in named restore point endpoint](https://junglewise.ai/threats/cve-2026-12050-pgadmin-4-sql-injection-in-named-restore-point-endpoint) (medium, CVSS 4.3, published 19 Jun 2026)
- [CVE-2026-12049: pgAdmin 4 open redirect in multi-factor authentication flow](https://junglewise.ai/threats/cve-2026-12049-pgadmin-4-open-redirect-in-multi-factor-authentication-flow) (medium, CVSS 4.3, published 19 Jun 2026)
- [CVE-2026-12048: PostgreSQL pgAdmin 4 stored XSS in error and plan rendering](https://junglewise.ai/threats/cve-2026-12048-postgresql-pgadmin-4-stored-xss-in-error-and-plan-rendering) (critical, CVSS 9.3, published 19 Jun 2026)
- [CVE-2026-12047: PostgreSQL pgAdmin 4 HTML injection in cloud deployment module](https://junglewise.ai/threats/cve-2026-12047-postgresql-pgadmin-4-html-injection-in-cloud-deployment-module) (low, CVSS 3.5, published 19 Jun 2026)
- [CVE-2026-12046: pgAdmin 4 unauthenticated RCE in SQL Editor via pickle deserialization](https://junglewise.ai/threats/cve-2026-12046-pgadmin-4-unauthenticated-rce-in-sql-editor-via-pickle) (critical, CVSS 9, published 19 Jun 2026)
- [CVE-2026-12045: pgAdmin 4 SQL injection and RCE in AI Assistant](https://junglewise.ai/threats/cve-2026-12045-pgadmin-4-sql-injection-and-rce-in-ai-assistant) (critical, CVSS 9, published 19 Jun 2026)
- [CVE-2026-12044: pgAdmin 4 SQL injection in multiple dialog templates and stats views](https://junglewise.ai/threats/cve-2026-12044-pgadmin-4-sql-injection-in-multiple-dialog-templates-and-stats) (high, CVSS 8.8, published 19 Jun 2026)
- [CVE-2026-7820: PostgreSQL pgAdmin 4 account lockout bypass in login views](https://junglewise.ai/threats/cve-2026-7820-postgresql-pgadmin-4-account-lockout-bypass-in-login-views) (medium, CVSS 6.5, published 11 May 2026)
- [CVE-2026-7819: PostgreSQL pgAdmin 4 symbolic-link path traversal in File Manager](https://junglewise.ai/threats/cve-2026-7819-postgresql-pgadmin-4-symbolic-link-path-traversal-in-file-manager) (high, CVSS 8.1, published 11 May 2026)
- [CVE-2026-7818: PostgreSQL pgAdmin 4 insecure deserialization in FileBackedSessionManager](https://junglewise.ai/threats/cve-2026-7818-postgresql-pgadmin-4-insecure-deserialization-in) (high, CVSS 7, published 11 May 2026)
- [CVE-2026-7817: PostgreSQL pgAdmin 4 LFI and SSRF in LLM API endpoints](https://junglewise.ai/threats/cve-2026-7817-postgresql-pgadmin-4-lfi-and-ssrf-in-llm-api-endpoints) (medium, CVSS 6.5, published 11 May 2026)
- [CVE-2026-7816: PostgreSQL pgAdmin 4 OS command injection in Import/Export query export](https://junglewise.ai/threats/cve-2026-7816-postgresql-pgadmin-4-os-command-injection-in-import-export-query) (high, CVSS 8.8, published 11 May 2026)
- [CVE-2026-7815: PostgreSQL pgAdmin 4 SQL injection in Maintenance Tool](https://junglewise.ai/threats/cve-2026-7815-postgresql-pgadmin-4-sql-injection-in-maintenance-tool) (high, CVSS 8.8, published 11 May 2026)
- [CVE-2026-7814: PostgreSQL pgAdmin 4 stored XSS in Browser Tree and Explain Visualizer](https://junglewise.ai/threats/cve-2026-7814-postgresql-pgadmin-4-stored-xss-in-browser-tree-and-explain) (medium, CVSS 4.8, published 11 May 2026)

## Most severe PostgreSQL pgAdmin 4 vulnerabilities

- [CVE-2026-7813: PostgreSQL pgAdmin 4 authorization bypass and RCE in server mode](https://junglewise.ai/threats/cve-2026-7813-postgresql-pgadmin-4-authorization-bypass-and-rce-in-server-mode) (critical, CVSS 9.9, published 11 May 2026)
- [CVE-2026-17566: pgAdmin 4 OS command injection in Import/Export Data tool](https://junglewise.ai/threats/cve-2026-17566-pgadmin-4-os-command-injection-in-import-export-data-tool) (critical, CVSS 9.9, published 31 Jul 2026)
- [CVE-2026-86863: pgAdmin 4 authentication bypass in webserver mode](https://junglewise.ai/threats/cve-2026-86863-pgadmin-4-authentication-bypass-in-webserver-mode) (critical, CVSS 9.8, published 17 Sep 2026)
- [CVE-2026-17349: PostgreSQL pgAdmin 4 credential leak in Workspaces adhoc connection](https://junglewise.ai/threats/cve-2026-17349-postgresql-pgadmin-4-credential-leak-in-workspaces-adhoc) (critical, CVSS 9.6, published 31 Jul 2026)
- [CVE-2026-12048: PostgreSQL pgAdmin 4 stored XSS in error and plan rendering](https://junglewise.ai/threats/cve-2026-12048-postgresql-pgadmin-4-stored-xss-in-error-and-plan-rendering) (critical, CVSS 9.3, published 19 Jun 2026)
- [CVE-2026-17351: pgAdmin 4 SQL injection bypass in AI Assistant](https://junglewise.ai/threats/cve-2026-17351-pgadmin-4-sql-injection-bypass-in-ai-assistant) (critical, CVSS 9, published 31 Jul 2026)
- [CVE-2026-12046: pgAdmin 4 unauthenticated RCE in SQL Editor via pickle deserialization](https://junglewise.ai/threats/cve-2026-12046-pgadmin-4-unauthenticated-rce-in-sql-editor-via-pickle) (critical, CVSS 9, published 19 Jun 2026)
- [CVE-2026-12045: pgAdmin 4 SQL injection and RCE in AI Assistant](https://junglewise.ai/threats/cve-2026-12045-pgadmin-4-sql-injection-and-rce-in-ai-assistant) (critical, CVSS 9, published 19 Jun 2026)
- [CVE-2026-7816: PostgreSQL pgAdmin 4 OS command injection in Import/Export query export](https://junglewise.ai/threats/cve-2026-7816-postgresql-pgadmin-4-os-command-injection-in-import-export-query) (high, CVSS 8.8, published 11 May 2026)
- [CVE-2026-7815: PostgreSQL pgAdmin 4 SQL injection in Maintenance Tool](https://junglewise.ai/threats/cve-2026-7815-postgresql-pgadmin-4-sql-injection-in-maintenance-tool) (high, CVSS 8.8, published 11 May 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 4 vulnerabilities in the four before. 0 critical against 1.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 4 | 1 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other PostgreSQL technologies

- [PostgreSQL](https://junglewise.ai/threats/technologies/postgresql): 64 vulnerabilities
- [PostgreSQL psqlODBC](https://junglewise.ai/threats/technologies/postgresql-psqlodbc): 10 vulnerabilities
- [PostgreSQL PgBouncer](https://junglewise.ai/threats/technologies/pgbouncer): 4 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "PostgreSQL pgAdmin 4 vulnerabilities", https://junglewise.ai/threats/technologies/pgadmin-4, 13 November 2026.