PatchTheCEVpgadmin vulnerabilities
Recent CVEs affecting pgadmin products. 7 tracked.
pgadmin has 7 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-07-31. Highest priority: CVE-2026-17566 (score 48/100).
- CVE-2026-17566 CRITICAL 9.9 UPGRADE pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQ
- CVE-2026-17346 HIGH 8.8 UPGRADE The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple
- CVE-2026-17349 CRITICAL 9.6 UPGRADE /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed
- CVE-2026-17351 CRITICAL 9.0 UPGRADE The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's exec
- CVE-2026-17347 HIGH 7.5 UPGRADE The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external com
- CVE-2026-17348 MEDIUM 6.5 UPGRADE In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the applica
- CVE-2026-17350 MEDIUM 5.4 UPGRADE The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did n
FAQ
How do I fix pgadmin vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pgadmin being exploited right now?
None of the tracked pgadmin CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pgadmin CVE should I patch first?
CVE-2026-17566 currently ranks highest (48/100): pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQ.