pgadmin
15 records · 15 with a public proof-of-concept
Disclosed vulnerabilities where the NVD names pgadmin as an affected vendor, highest CVSS first.
- CRITICAL 9.9CVE-2026-116241public PoC
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not …
pgadmin 4
- CRITICAL 9.8CVE-2026-86863public PoC
pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.get_user() read config.WEBSERVER_REMOTE_USER from…
pgadmin 4
- HIGH 8.8CVE-2026-86864public PoC
pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, whic…
pgadmin 4
- HIGH 8.5CVE-2026-116239public PoC
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or…
pgadmin 4
- HIGH 8.2CVE-2026-116247public PoC
When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running…
pgadmin 4
- HIGH 8.2CVE-2026-116245public PoC
libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's Service, or a "service…
pgadmin 4
- HIGH 8.2CVE-2026-116244public PoC
When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account ru…
pgadmin 4
- HIGH 8.2CVE-2026-116242public PoC
pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that account's ~/.ssh/config …
pgadmin 4
- HIGH 7.5CVE-2026-116243public PoC
pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SHARED_STORAGE directory,…
pgadmin 4
- MEDIUM 6.5CVE-2026-116252public PoC
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the host, port and other s…
pgadmin 4
- MEDIUM 6.5CVE-2026-116246public PoC
To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing remove…
pgadmin 4
- MEDIUM 6.5CVE-2026-116240public PoC
In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with get_abs_path(). Several callers then acted on a path they built differently, so the path checked and the path used c…
pgadmin 4
- MEDIUM 6.5CVE-2026-86862public PoC
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq expands a database name containing an equals sign into a full connection string, and connecti…
pgadmin 4
- MEDIUM 5.9CVE-2026-86861public PoC
pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had previously har…
pgadmin 4
- MEDIUM 4.2CVE-2026-116251public PoC
pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on anoth…
pgadmin 4