Critical vulnerability
Critical vulnerability in pgAdmin (CVE-2026-116238)
pgAdmin · Servers and applications
CVE-2026-116238
pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
- Severity
- Critical 9.2
- Published
- 30 Oct 2026
- Fixed in
- 9.19
In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: - Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view…
| Software | Affected versions |
|---|---|
| pgAdminServers and applications |
|
| pgAdminServers and applications |
|
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.