Back
Critical pgAdmin Vulnerabilities Expose a Hidden Weakness in PostgreSQL Environments

Critical pgAdmin Vulnerabilities Expose a Hidden Weakness in PostgreSQL Environments

WARNING Publication date: 2025-11-13

Most teams focus their PostgreSQL security efforts on the database server itself: patching the engine, restricting ports, and tightening authentication. But in modern environments, the database engine is rarely the weakest link. Your administrative tools often are—especially pgAdmin.

In November 2025, several new pgAdmin vulnerabilities were disclosed, including multiple high-impact findings such as remote code execution (RCE) and authentication bypasses. These issues serve as a reminder that the tools around a database can introduce more risk than the database engine they manage.

Meanwhile, PostgreSQL itself received two updates addressing lower-impact issues. This article summarizes all newly disclosed vulnerabilities and explains how to check whether your system is affected.

 

Newly Disclosed Vulnerabilities

CVE CVSS Component Summary
CVE-2025-12762 9.1 pgAdmin Critical RCE when restoring PLAIN-format dump files.
CVE-2025-12765 7.5 pgAdmin TLS certificate verification bypass in LDAP.
CVE-2025-12764 7.5 pgAdmin LDAP injection leading to DoS conditions.
CVE-2025-12763 6.8 pgAdmin Command injection on Windows via crafted backup paths.
CVE-2025-12818 5.9 PostgreSQL / libpq Integer wraparound causing memory corruption and segmentation faults.
CVE-2025-12817 3.1 PostgreSQL Missing authorization in CREATE STATISTICS may trigger DoS for analytics workloads.

Observation:
The PostgreSQL engine vulnerabilities are relatively mild.
The pgAdmin issues are where the real danger lies.

 

Why These pgAdmin Vulnerabilities Matter

pgAdmin is widely deployed—often installed and forgotten, running on internal servers, sometimes in shared multi-user mode. This makes it a tempting target.

The newly disclosed issues include:

• Remote Code Execution (CVE-2025-12762)
Attackers can inject commands into restore operations and execute them on the pgAdmin host.

• Authentication Weaknesses (CVE-2025-12765, CVE-2025-12764)
Weak TLS validation and LDAP injection can expose credentials or disrupt authentication.

• Command Injection on Windows (CVE-2025-12763)
Backup and restore paths can be abused to run arbitrary commands.

An attacker compromising pgAdmin can:

  • Extract database credentials
  • Manipulate backups
  • Move laterally toward PostgreSQL servers
  • Execute arbitrary code in server mode

 

How to Check if You Are Affected

Check PostgreSQL Version

Linux:

psql --version

Windows (PowerShell):

psql --version

macOS (Homebrew):

brew list | grep postgresql
psql --version

You are likely vulnerable if your version is below:

  • 13.23
  • 14.20
  • 15.15
  • 16.11
  • 17.7
  • 18.1

Check pgAdmin Version

pgAdmin Desktop (Linux/macOS):

pgadmin4 --version

pgAdmin Desktop (Windows PowerShell):

Get-Command "pgAdmin4.exe"

pgAdmin Server Mode (Python/pip deployment):

pip show pgadmin4

You are vulnerable to the pgAdmin issues mentioned above if the version is ≤ 9.9.

Check for Running pgAdmin Processes

Linux:

ps aux | grep pgadmin

Windows (PowerShell):

Get-Process | Where-Object {$_.ProcessName -like "*pgadmin*"}

Check for LDAP Configuration (If in Use)

If you run pgAdmin in server mode and use LDAP, verify the configuration file:

grep -R "AUTHENTICATION_SOURCES" /path/to/pgadmin4/

If LDAP is enabled and pgAdmin is below the patched release (above 9.9), updating should be treated as urgent due to the authentication-related vulnerabilities.

 

Recommended Actions

  1. Update pgAdmin immediately to a fixed release (critical RCE and LDAP-related issues).
  2. Patch PostgreSQL to the latest minor version in your series (13.23, 14.20, 15.15, 16.11, 17.7, or 18.1).
  3. Review pgAdmin deployments, especially shared server-mode instances accessed by multiple users.
  4. Harden backup and restore workflows and restrict who can upload or restore dump files.

 

How BaseFortify Helps

BaseFortify can help bring structure and visibility to this type of issue:

  • Automated asset identification for PostgreSQL, pgAdmin, and supporting tools across your environment.
  • Vulnerability matching that links detected software versions to relevant CVEs, including the ones listed here.
  • Annotated CVE reports with practical, security-focused explanations instead of raw JSON output.
  • Security insights that highlight outdated or misconfigured components before they become a problem.

You can start monitoring your environment for free and see where these vulnerabilities apply in practice:

https://basefortify.eu/register

 

Resources