Chainpgadmin.org · pgAdmin 4PyPI:pgadmin4
pgadmin.org pgAdmin 4: fix bypasses (2022–2026)
8 CVEs over 3 generations, 16 Mar 2022 to 30 Oct 2026.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2022-095916 Mar 2022 First in the chain
- CVE-2024-31164 Apr 2024 No direct link to an earlier CVE
- CVE-2024-42152 May 2024 related to CVE-2024-3116related to CVE-2022-0959
- CVE-2024-42162 May 2024 related to CVE-2024-3116
- CVE-2025-1276213 Nov 2025 related to CVE-2024-4215
- CVE-2025-1378011 Dec 2025 related to CVE-2024-4215
- CVE-2026-1756631 Jul 2026 No direct link to an earlier CVE
- CVE-2026-11624130 Oct 2026 bypassed the fix for CVE-2026-17566related to CVE-2024-4215
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2022-0959 | 16 Mar 2022 | A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and… · fixed in 6.7 | First in chain | 12.4 |
| CVE-2024-3116 | 4 Apr 2024 | Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 · fixed in 8.5 | First in chain | 30.0 |
| CVE-2024-4215 | 2 May 2024 | The Multi Factor Authentication bypass vulnerability in pgAdmin 4 · fixed in 8.6 | CVE-2024-3116 · related · High | 15.3 |
| CVE-2024-4216 | 2 May 2024 | XSS vulnerability in /settings/store API response json payload in pgAdmin 4 · fixed in 8.6 | CVE-2024-3116 · related · Medium | 13.2 |
| CVE-2025-12762 | 13 Nov 2025 | Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) | CVE-2024-4215 · related · Medium | 30.6 |
| CVE-2025-13780 | 11 Dec 2025 | Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) · fixed in 9.11 | CVE-2024-4215 · related · Medium | 23.6 |
| CVE-2026-17566 | 31 Jul 2026 | pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to… | First in chain | 22.4 |
| CVE-2026-116241 | 30 Oct 2026 | pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the… | CVE-2026-17566 · bypassed the fix · High | 6.9 |