pgAdmin 4 - Authentication Bypass

pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. id: CVE-2024-9014 info: name: pgAdmin 4 - Authentication Bypass author...

CVE-2024-9014

This post is a research article published by EQSTLab. CVE-2024-9014 ★ CVE-2024-9014 Sensitive Information Exposure PoC ★ Description CVE-2024-9014 : pgAdmin4 Sensitive Information Exposure description: pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication...

CVE-2026-116250

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with checkaccesspermission and then opened it by name. Several places opened it with a plain open or handed the path to a utility that opened it later: the servers.json export and import and the import fi...

CVE-2026-116249

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "..//.pgpass", set through the server dialog, t...

CVE-2026-116243

pgAdmin 4 runs pgdump, pgrestore, pgdumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGEDIR, not under a SHAREDSTORAGE directory, which ordinary users can upload files to. A...

CVE-2026-116248

In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the "shared" flag and shared username they were sent, so any user able to register a...

CVE-2026-116239

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's...

CVE-2026-116241

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy ... TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, wher...

CVE-2026-116242

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither hostpkeydirectories nor sshconfigfile, so it always loaded the unencrypted private keys in /.ssh of the operating-system account running pgAdmin, read that account's /.ssh/config IdentityFile, User, HostName, ProxyCommand...

CVE-2026-116238

In server mode pgAdmin 4 locks an internal account after MAXLOGINATTEMPTS failed logins 3 by default. The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: ...

EUVD-2026-114393

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" or a postgresql:// URI as a full connection string, whose keywords override the host, port and other settings pgAdmin had supplied. A databas...

CVE-2026-116252

pgAdmin 4 versions before 9.19 are vulnerable to a security flaw where the materialized view refresh function passes the target database's name to the psql command's --dbname argument without modification. Because libpq interprets values containing = or postgresql:// URIs as full connection strin...

CVE-2026-116251 pgAdmin 4: A user's other sessions survive a change of their password

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had...

CVE-2026-116251

Versions of pgAdmin 4 prior to 9.19 are vulnerable to a flaw where existing user sessions are not invalidated when a password is changed (either by the user or an administrator). This allows sessions established before the change, such as those on other devices or by unauthorized parties with old...

EUVD-2026-114392

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had...

EUVD-2026-114390

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "..//.pgpass", set through the server dialog, t...

EUVD-2026-114391

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with checkaccesspermission and then opened it by name. Several places opened it with a plain open or handed the path to a utility that opened it later: the servers.json export and import and the import fi...

CVE-2026-116249 pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "..//.pgpass", set through the server dialog, t...

CVE-2026-116250 pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with checkaccesspermission and then opened it by name. Several places opened it with a plain open or handed the path to a utility that opened it later: the servers.json export and import and the import fi...

CVE-2026-116249

In pgAdmin 4 versions before 9.19 , a vulnerability exists where the application fails to properly sanitize file paths relative to the user's storage directory. Because get_complete_file_path() only strips leading slashes, an attacker can use path traversal sequences (e.g., ..//.pgpass) via the s...