CVE-2024-3116: pgAdmin4 Remote Code Execution (RCE) Vulnerability
Summary
CVE-2024-3116: pgAdmin Remote Code Execution (RCE) vulnerability. Affects pgadmin4 versions < 8.5. Fixed in 8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin4 is a popular open-source administration and management platform for PostgreSQL databases. It provides a web-based interface for users to interact with their databases, perform administrative tasks, and manage database objects. pgAdmin4 is written in Python and is available on the Python Package Index (PyPI). This vulnerability affects pgAdmin4 versions up to 8.4.
Vulnerability Detail
The pgAdmin4 Remote Code Execution (RCE) vulnerability, identified as CVE-2024-3116, allows attackers to execute arbitrary code on the server hosting pgAdmin. The vulnerability stems from a flaw in the validate binary path API. Exploiting this vulnerability poses a severe risk to the integrity of the database management system and the security of the underlying data. Attackers can leverage this vulnerability to gain unauthorized access, manipulate data, or disrupt the availability of the database.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.5
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==8.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can consider implementing access controls and firewall rules to restrict access to the pgAdmin4 server. Additionally, it is advisable to monitor server logs for any suspicious activity and promptly apply security updates as they become available.
Conclusion
The pgAdmin4 Remote Code Execution (RCE) vulnerability is a critical security issue that allows attackers to execute arbitrary code on the server hosting pgAdmin. Upgrading to pgAdmin4 version 8.5 or later is crucial to mitigate this vulnerability and ensure the security of the database management system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pgadmin4 →
FAQ
pgAdmin4 is an open-source administration and management platform for PostgreSQL databases. It provides a web-based interface for users to interact with their databases, perform administrative tasks, and manage database objects.
This vulnerability allows attackers to execute arbitrary code on the server hosting pgAdmin4, posing a severe risk to the integrity of the database management system and the security of the underlying data. Attackers can gain unauthorized access, manipulate data, or disrupt the availability of the database.
To fix this vulnerability, it is recommended to upgrade pgAdmin4 to version 8.5 or later. The latest release includes necessary security patches and fixes to mitigate the vulnerability.
As a temporary workaround, users can implement access controls and firewall rules to restrict access to the pgAdmin4 server. It is also important to monitor server logs for any suspicious activity and apply security updates promptly.
For more information about this vulnerability, you can refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-27jx-ffw8-xrqv/GHSA-27jx-ffw8-xrqv.json
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
