PostgreSQL pgAdmin pgAdmin is an administration tool for PostgreSQL databases
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in PostgreSQL pgAdmin.
By the Year
In 2026 there have been 1 vulnerability in PostgreSQL pgAdmin with an average score of 7.4 out of ten. Last year, in 2025 pgAdmin had 1 security vulnerability published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in pgAdmin in 2026 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.30.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1 | 7.40 |
| 2025 | 1 | 6.10 |
| 2024 | 1 | 0.00 |
| 2023 | 1 | 6.50 |
| 2022 | 2 | 7.65 |
It may take a day or so for new pgAdmin vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent PostgreSQL pgAdmin Security Vulnerabilities
pgAdmin 9.11 Restore Key Bypass Enables Remote Exec
CVE-2026-1707
7.4 - High
- February 05, 2026
pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\unrestrict <key>`. This results in reliable command execution on the pgAdmin host during the restore operation.
Authorization
pgAdmin <=9.1 XSS via Query Result Rendering
CVE-2025-2946
6.1 - Medium
- April 03, 2025
pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.
XSS in pgAdmin <=8.5 /settings/store API (CVE-2024-4216)
CVE-2024-4216
- May 02, 2024
pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.
pgAdmin 4 <v6.19 DTR: Alter User Settings & DB
CVE-2023-0241
6.5 - Medium
- March 27, 2023
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
Directory traversal
Unauthenticated API Hijack in pgAdmin <6.17 via Path Execution
CVE-2022-4223
8.8 - High
- December 13, 2022
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.
AuthZ
A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location
CVE-2022-0959
6.5 - Medium
- March 16, 2022
A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.
Directory traversal
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for PostgreSQL pgAdmin or by PostgreSQL? Click the Watch button to subscribe.
