High severity · published May 2, 2024
CVE-2024-4215
The Multi Factor Authentication bypass vulnerability in pgAdmin 4
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
P4
pgAdmin 4 · pgadmin.org
before 8.6 · source: vendor, NVD
FE
Fedora · Fedoraproject
40 · source: NVD
PG
Pgadmin · Postgresql
through 8.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4215
Issue Tracking
https://github.com/pgadmin-org/pgadmin4/issues/7425
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/
More from pgAdmin 4
9.9
CVE-2026-17566
pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
9.9
CVE-2026-7813
pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode
9.8
CVE-2026-86863
pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode
9.8
CVE-2025-12762
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
9.8
CVE-2024-3116
Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4