pgadmin.org pgAdmin vulnerabilities and fixes
Exploited and high-severity pgadmin.org pgAdmin vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 8.4CVE-2026-116249pgAdmin 4: Connection file paths and parameter keys escape the user's storage directoryFix availablepgadmin.org pgAdmin 4
1 min read - 7.5CVE-2026-116243pgAdmin 4: Utility binary path can point at a shared storage directoryFix availablepgadmin.org pgAdmin 4
1 min read - 8.2CVE-2026-116244pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentialsFix availablepgadmin.org pgAdmin 4
1 min read - 8.2CVE-2026-116245pgAdmin 4: Connection services are not restricted in server modeFix availablepgadmin.org pgAdmin 4
1 min read - 8.2CVE-2026-116247pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificateFix availablepgadmin.org pgAdmin 4
1 min read - 8.5CVE-2026-116239pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernameFix availablepgadmin.org pgAdmin 4
2 min read - 9.9CVE-2026-116241pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifierRCEFix availablepgadmin.org pgAdmin 4
2 min read - 8.2CVE-2026-116242pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identityFix availablepgadmin.org pgAdmin 4
1 min read - 8.1CVE-2026-116238pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checksFix availablepgadmin.org pgAdmin 4
2 min read