# Pgadmin 4 vulnerabilities Source: https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Pgadmin 4: 0 in the last 7 days and 9 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116251, was published on 30 October 2026. 9 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 9 - Last 90 days: 9 - All time: 14 (2 critical, 0 exploited in the wild) ## About Pgadmin 4 Web-based database administration and management tool for PostgreSQL. ## Latest Pgadmin 4 vulnerabilities - [CVE-2026-116251: pgAdmin 4 session invalidation failure after password change](https://junglewise.ai/threats/cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when) (medium, CVSS 4.2, published 30 Oct 2026) - [CVE-2026-116249: pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl) (high, CVSS 8.4, published 30 Oct 2026) - [CVE-2026-116248: pgAdmin 4 unauthorized server sharing to all users](https://junglewise.ai/threats/cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share) (medium, CVSS 6.8, published 30 Oct 2026) - [CVE-2026-116245: pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116244: pgAdmin 4 Kerberos credential exposure authentication bypass](https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116243: pgAdmin 4 arbitrary code execution via binary path validation bypass](https://junglewise.ai/threats/cve-2026-116243-pgadmin-4-runs-pg-dump-pg-restore-pg-dumpall-and-psql-from-the) (high, CVSS 7.5, published 30 Oct 2026) - [CVE-2026-116242: pgAdmin 4 SSH tunnel privilege escalation via service account keys](https://junglewise.ai/threats/cve-2026-116242-pgadmin-4-opens-ssh-tunnels-with-the-sshtunnel-library-but-gave) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116240: pgAdmin 4 path traversal in storage directory access](https://junglewise.ai/threats/cve-2026-116240-in-server-mode-pgadmin-4-validates-a-path-into-the-user-s) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-116238: pgAdmin 4 account lockout bypass and unlimited password guessing](https://junglewise.ai/threats/cve-2026-116238-in-server-mode-pgadmin-4-locks-an-internal-account-after-max) (high, CVSS 8.1, published 30 Oct 2026) - [CVE-2025-13780: PYSEC-2026-450 - pgadmin4 has a Meta-Command Filter Command Execution](https://junglewise.ai/threats/cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution) (critical, CVSS 9.1, published 11 Dec 2025) - [CVE-2025-12765: pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate…](https://junglewise.ai/threats/cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that) (high, CVSS 7.5, published 13 Nov 2025) - [CVE-2025-12764: PYSEC-2026-1772 - pgAdmin is affected by an LDAP injection vulnerability](https://junglewise.ai/threats/cve-2025-12764-pgadmin-is-affected-by-an-ldap-injection-vulnerability) (high, CVSS 7.5, published 13 Nov 2025) - [CVE-2025-12763: PYSEC-2026-1776 - pgAdmin 4 has command injection vulnerability on Windows systems](https://junglewise.ai/threats/cve-2025-12763-pgadmin-4-has-command-injection-vulnerability-on-windows-systems) (medium, CVSS 6.8, published 13 Nov 2025) - [CVE-2025-12762: PYSEC-2026-454 - pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode](https://junglewise.ai/threats/cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in) (critical, CVSS 9.1, published 13 Nov 2025) ## Most severe Pgadmin 4 vulnerabilities - [CVE-2025-12762: PYSEC-2026-454 - pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode](https://junglewise.ai/threats/cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in) (critical, CVSS 9.1, published 13 Nov 2025) - [CVE-2025-13780: PYSEC-2026-450 - pgadmin4 has a Meta-Command Filter Command Execution](https://junglewise.ai/threats/cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution) (critical, CVSS 9.1, published 11 Dec 2025) - [CVE-2026-116249: pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl) (high, CVSS 8.4, published 30 Oct 2026) - [CVE-2026-116245: pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116244: pgAdmin 4 Kerberos credential exposure authentication bypass](https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116242: pgAdmin 4 SSH tunnel privilege escalation via service account keys](https://junglewise.ai/threats/cve-2026-116242-pgadmin-4-opens-ssh-tunnels-with-the-sshtunnel-library-but-gave) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116238: pgAdmin 4 account lockout bypass and unlimited password guessing](https://junglewise.ai/threats/cve-2026-116238-in-server-mode-pgadmin-4-locks-an-internal-account-after-max) (high, CVSS 8.1, published 30 Oct 2026) - [CVE-2025-12764: PYSEC-2026-1772 - pgAdmin is affected by an LDAP injection vulnerability](https://junglewise.ai/threats/cve-2025-12764-pgadmin-is-affected-by-an-ldap-injection-vulnerability) (high, CVSS 7.5, published 13 Nov 2025) - [CVE-2025-12765: pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate…](https://junglewise.ai/threats/cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that) (high, CVSS 7.5, published 13 Nov 2025) - [CVE-2026-116243: pgAdmin 4 arbitrary code execution via binary path validation bypass](https://junglewise.ai/threats/cve-2026-116243-pgadmin-4-runs-pg-dump-pg-restore-pg-dumpall-and-psql-from-the) (high, CVSS 7.5, published 30 Oct 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 9 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Pgadmin 4 vulnerabilities", https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4, 9 November 2026.