# pgAdmin vulnerabilities Source: https://junglewise.ai/threats/vendors/pgadmin Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/pgadmin.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 21 vulnerabilities in pgAdmin: 0 in the last 7 days and 12 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116251, was published on 30 October 2026. 9 vulnerabilities in the last four weeks, up 200% on the four before (3). 0 critical against 1. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 9 - Last 90 days: 12 - All time: 21 (4 critical, 0 exploited in the wild) ## About pgAdmin PostgreSQL database administration and management web interface. ## Latest pgAdmin vulnerabilities - [CVE-2026-116251: pgAdmin 4 session invalidation failure after password change](https://junglewise.ai/threats/cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when) (medium, CVSS 4.2, published 30 Oct 2026) - [CVE-2026-116249: pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl) (high, CVSS 8.4, published 30 Oct 2026) - [CVE-2026-116248: pgAdmin 4 unauthorized server sharing to all users](https://junglewise.ai/threats/cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share) (medium, CVSS 6.8, published 30 Oct 2026) - [CVE-2026-116245: pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116244: pgAdmin 4 Kerberos credential exposure authentication bypass](https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116243: pgAdmin 4 arbitrary code execution via binary path validation bypass](https://junglewise.ai/threats/cve-2026-116243-pgadmin-4-runs-pg-dump-pg-restore-pg-dumpall-and-psql-from-the) (high, CVSS 7.5, published 30 Oct 2026) - [CVE-2026-116242: pgAdmin 4 SSH tunnel privilege escalation via service account keys](https://junglewise.ai/threats/cve-2026-116242-pgadmin-4-opens-ssh-tunnels-with-the-sshtunnel-library-but-gave) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116240: pgAdmin 4 path traversal in storage directory access](https://junglewise.ai/threats/cve-2026-116240-in-server-mode-pgadmin-4-validates-a-path-into-the-user-s) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-116238: pgAdmin 4 account lockout bypass and unlimited password guessing](https://junglewise.ai/threats/cve-2026-116238-in-server-mode-pgadmin-4-locks-an-internal-account-after-max) (high, CVSS 8.1, published 30 Oct 2026) - [CVE-2026-86863: pgAdmin 4 authentication bypass in webserver mode](https://junglewise.ai/threats/cve-2026-86863-pgadmin-4-authentication-bypass-in-webserver-mode) (critical, CVSS 9.8, published 17 Sep 2026) - [CVE-2026-86862: pgAdmin 4 connection string injection in Restore and Maintenance tools](https://junglewise.ai/threats/cve-2026-86862-pgadmin-4-connection-string-injection-in-restore-and-maintenance) (medium, CVSS 6.5, published 17 Sep 2026) - [CVE-2026-86861: pgAdmin 4 File Manager TOCTOU symlink write bypass in save_file](https://junglewise.ai/threats/cve-2026-86861-pgadmin-4-file-manager-toctou-symlink-write-bypass-in-save-file) (medium, CVSS 5.9, published 17 Sep 2026) - [CVE-2026-17351: pgAdmin 4 SQL injection bypass in AI Assistant](https://junglewise.ai/threats/cve-2026-17351-pgadmin-4-sql-injection-bypass-in-ai-assistant) (critical, CVSS 9, published 31 Jul 2026) - [CVE-2024-4215: PYSEC-2026-1768 - pgAdmin is affected by a multi-factor authentication bypass vulnerability](https://junglewise.ai/threats/cve-2024-4215-pgadmin-multi-factor-authentication-bypass) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-3116: PYSEC-2026-1767 - pgAdmin Remote Code Execution (RCE) vulnerability](https://junglewise.ai/threats/cve-2024-3116-pgadmin-remote-code-execution-in-binary-path-validation) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-12044: pgAdmin 4 SQL injection in multiple dialog templates and stats views](https://junglewise.ai/threats/cve-2026-12044-pgadmin-4-sql-injection-in-multiple-dialog-templates-and-stats) (high, CVSS 8.8, published 19 Jun 2026) - [CVE-2025-13780: PYSEC-2026-450 - pgadmin4 has a Meta-Command Filter Command Execution](https://junglewise.ai/threats/cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution) (critical, CVSS 9.1, published 11 Dec 2025) - [CVE-2025-12765: pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate…](https://junglewise.ai/threats/cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that) (high, CVSS 7.5, published 13 Nov 2025) - [CVE-2025-12764: PYSEC-2026-1772 - pgAdmin is affected by an LDAP injection vulnerability](https://junglewise.ai/threats/cve-2025-12764-pgadmin-is-affected-by-an-ldap-injection-vulnerability) (high, CVSS 7.5, published 13 Nov 2025) - [CVE-2025-12763: PYSEC-2026-1776 - pgAdmin 4 has command injection vulnerability on Windows systems](https://junglewise.ai/threats/cve-2025-12763-pgadmin-4-has-command-injection-vulnerability-on-windows-systems) (medium, CVSS 6.8, published 13 Nov 2025) - [CVE-2025-12762: PYSEC-2026-454 - pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode](https://junglewise.ai/threats/cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in) (critical, CVSS 9.1, published 13 Nov 2025) ## Most severe pgAdmin vulnerabilities - [CVE-2026-86863: pgAdmin 4 authentication bypass in webserver mode](https://junglewise.ai/threats/cve-2026-86863-pgadmin-4-authentication-bypass-in-webserver-mode) (critical, CVSS 9.8, published 17 Sep 2026) - [CVE-2025-12762: PYSEC-2026-454 - pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode](https://junglewise.ai/threats/cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in) (critical, CVSS 9.1, published 13 Nov 2025) - [CVE-2025-13780: PYSEC-2026-450 - pgadmin4 has a Meta-Command Filter Command Execution](https://junglewise.ai/threats/cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution) (critical, CVSS 9.1, published 11 Dec 2025) - [CVE-2026-17351: pgAdmin 4 SQL injection bypass in AI Assistant](https://junglewise.ai/threats/cve-2026-17351-pgadmin-4-sql-injection-bypass-in-ai-assistant) (critical, CVSS 9, published 31 Jul 2026) - [CVE-2026-12044: pgAdmin 4 SQL injection in multiple dialog templates and stats views](https://junglewise.ai/threats/cve-2026-12044-pgadmin-4-sql-injection-in-multiple-dialog-templates-and-stats) (high, CVSS 8.8, published 19 Jun 2026) - [CVE-2026-116249: pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl) (high, CVSS 8.4, published 30 Oct 2026) - [CVE-2026-116245: pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116244: pgAdmin 4 Kerberos credential exposure authentication bypass](https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116242: pgAdmin 4 SSH tunnel privilege escalation via service account keys](https://junglewise.ai/threats/cve-2026-116242-pgadmin-4-opens-ssh-tunnels-with-the-sshtunnel-library-but-gave) (high, CVSS 8.2, published 30 Oct 2026) - [CVE-2026-116238: pgAdmin 4 account lockout bypass and unlimited password guessing](https://junglewise.ai/threats/cve-2026-116238-in-server-mode-pgadmin-4-locks-an-internal-account-after-max) (high, CVSS 8.1, published 30 Oct 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up 200% on the four before (3). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 3 | 1 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 9 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## pgAdmin technologies - [Pgadmin 4](https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4): 14 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "pgAdmin vulnerabilities", https://junglewise.ai/threats/vendors/pgadmin, 9 November 2026.