CVE-2025-12764VulnerabilityPublished 13 Nov 2025

CVE-2025-12764: pgAdmin 4 · Vulnerability

Affects pgAdmin 4Source CVE Database V5

Not known to be exploited · CVSS 7.5 High.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 13 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
pgadmin.org pgAdmin 4	Affected =0	Fixed in–

AI-suggested

To mitigate CVE-2025-12764, organizations should implement strict input validation and sanitization on all LDAP authentication inputs within pgAdmin 4 to neutralize special LDAP characters before query construction. Network-level protections such as rate limiting and anomaly detection on LDAP traffic can help identify and block abnormal query patterns indicative of injection attempts. Monitoring LDAP server performance metrics and logs for unusual spikes in processing or query volume is essential for early detection. Until an official patch is released by pgadmin.org, consider temporarily disabling LDAP authentication in pgAdmin 4 or restricting access to trusted networks only. Employing web application firewalls (WAFs) with LDAP injection detection capabilities can provide an additional security layer. Finally, maintain up-to-date backups and incident response plans to quickly recover from potential DoS incidents.

Description

CVE-2025-12764 is a high-severity LDAP injection vulnerability affecting pgAdmin 4 versions up to 9.9. The flaw exists in the LDAP authentication flow, where specially crafted usernames containing LDAP special characters can cause excessive processing by the LDAP server and client, resulting in a denial-of-service (DoS) condition. This vulnerability does not impact confidentiality or integrity but can severely affect availability by overwhelming directory services. Exploitation requires no authentication or user interaction and can be performed remotely over the network. No known exploits are currently reported in the wild. European organizations using pgAdmin 4 with LDAP authentication are at risk, especially those with critical PostgreSQL database infrastructure. Mitigation involves input validation and sanitization of LDAP queries, monitoring LDAP server performance, and applying vendor patches once available. Countries with significant PostgreSQL adoption and critical infrastructure relying on LDAP authentication, such as Germany, France, and the UK, are most likely to be affected.

Impact

For European organizations, the primary impact of CVE-2025-12764 is the potential denial-of-service of LDAP authentication services used by pgAdmin 4. This can lead to unavailability of database management interfaces, delaying critical administrative tasks and potentially causing operational disruptions. Organizations with large-scale PostgreSQL deployments that integrate LDAP for centralized authentication are particularly vulnerable. Disruption in database administration can cascade into broader IT service interruptions, affecting business continuity. Additionally, if LDAP servers are overwhelmed, other services relying on LDAP for authentication may also experience degraded performance or outages. This is especially critical for sectors such as finance, healthcare, and government, where database availability and integrity of authentication services are paramount. The vulnerability’s ease of exploitation and network accessibility increase the risk of targeted attacks or opportunistic scanning by threat actors.

Summary

CVE-2025-12764 identifies an LDAP injection vulnerability in pgAdmin 4 versions up to 9.9, a popular open-source administration and management tool for PostgreSQL databases. The vulnerability arises from improper handling of user-supplied input in the LDAP authentication mechanism. Specifically, attackers can inject special LDAP characters into the username field, which leads to the construction of malicious LDAP queries. These malformed queries cause the LDAP server and client to process an unusually large amount of data, effectively resulting in a denial-of-service (DoS) attack by exhausting resources. The vulnerability is classified under CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query). The CVSS v3.1 base score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability. While no exploits have been observed in the wild yet, the flaw poses a significant risk to systems relying on LDAP authentication via pgAdmin 4. The lack of patches at the time of publication necessitates immediate defensive measures to prevent exploitation. The vulnerability does not compromise confidentiality or integrity but can disrupt database administration workflows and potentially impact dependent services.

CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') (opens in a new tab)
Base weaknessOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
LDAP Injection Prevention (opens in a new tab)
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
Injection Prevention (opens in a new tab)
SQL Injection Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V5.3.7 (opens in a new tab)
V1.5.1 (opens in a new tab)
Attack patterns
LDAP Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

github.com/pgadmin-org/pgadmin4/issues/9325 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Nov 2025, 14:18 UTC

WeaknessesCWE-90

Technical details

References

Community reviews

Related threats