| CVE-2026-116252 |
pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name
|
6.5
Medium
|
Oct 30, 2026 |
| CVE-2026-116251 |
pgAdmin 4: A user's other sessions survive a change of their password
|
4.2
Medium
|
Oct 30, 2026 |
| CVE-2026-116249 |
pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
|
8.4
High
|
Oct 30, 2026 |
| CVE-2026-116250 |
pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check
|
6.5
Medium
|
Oct 30, 2026 |
| CVE-2026-116248 |
pgAdmin 4: Non-administrators can share a server with every user
|
6.8
Medium
|
Oct 30, 2026 |
| CVE-2026-116246 |
pgAdmin 4: Server passwords are left in pgAdmin's process environment
|
6.5
Medium
|
Oct 30, 2026 |
| CVE-2026-116247 |
pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate
|
8.2
High
|
Oct 30, 2026 |
| CVE-2026-116244 |
pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
|
8.2
High
|
Oct 30, 2026 |
| CVE-2026-116245 |
pgAdmin 4: Connection services are not restricted in server mode
|
8.2
High
|
Oct 30, 2026 |
| CVE-2026-116243 |
pgAdmin 4: Utility binary path can point at a shared storage directory
|
7.5
High
|
Oct 30, 2026 |
| CVE-2026-116242 |
pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
|
8.2
High
|
Oct 30, 2026 |
| CVE-2026-116241 |
pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier
|
9.9
Critical
|
Oct 30, 2026 |
| CVE-2026-116239 |
pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username
|
8.5
High
|
Oct 30, 2026 |
| CVE-2026-116240 |
pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked
|
6.5
Medium
|
Oct 30, 2026 |
| CVE-2026-116238 |
pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
|
8.1
High
|
Oct 30, 2026 |
| CVE-2026-86864 |
pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the…
|
8.8
High
|
Sep 17, 2026 |
| CVE-2026-86863 |
pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse…
|
9.8
Critical
|
Sep 17, 2026 |
| CVE-2026-86862 |
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the…
|
6.5
Medium
|
Sep 17, 2026 |
| CVE-2026-86861 |
pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested…
|
5.9
Medium
|
Sep 17, 2026 |
| CVE-2026-17566 |
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query…
|
9.9
Critical
|
Jul 31, 2026 |
| CVE-2026-17351 |
The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's…
|
9.0
Critical
|
Jul 31, 2026 |
| CVE-2026-17350 |
The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce…
|
5.4
Medium
|
Jul 31, 2026 |
| CVE-2026-17349 |
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id…
|
9.6
Critical
|
Jul 31, 2026 |
| CVE-2026-17348 |
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's…
|
6.5
Medium
|
Jul 31, 2026 |
| CVE-2026-17347 |
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command…
|
7.5
High
|
Jul 31, 2026 |