CVE-2025-12764 pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.
Attackers can cause denial of service in pgAdmin 4 by injecting LDAP characters during authentication when LDAP is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-12764?
CVE-2025-12764 is a high-severity vulnerability in pgadmin.org pgAdmin 4, published on 13 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.
Weakness: CWE-90
Which versions are affected by CVE-2025-12764?
3 open source packages ship an affected version, including pgadmin4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pgadmin4 PyPI | All versions | 9.10 |
pgadmin4 PyPI | All versions | 9.10 |
pgadmin4 PyPI | All versions | 9.10 |
Products include Pgadmin Pgadmin 4.
How do I fix CVE-2025-12764?
Upgrade pgadmin4 to 9.10 or later.
Is CVE-2025-12764 being exploited?
There is no known exploitation of CVE-2025-12764 in the wild and no public exploit code.
Other vulnerabilities in pgadmin.org pgAdmin 4
- CVE-2025-2945 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
- CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4
- CVE-2026-12046 Deserialization in pgAdmin 4
- CVE-2026-17351 SQL injection in pgAdmin 4
- CVE-2026-17566 Command injection in pgAdmin 4
Sources
Also known as GHSA-cvf4-f829-762v, PYSEC-2026-1772.