pgAdmin4 Authentication Bypass via Deserialization (CVE-2024-5910)

CVE-2024-5910 is an authentication bypass in pgAdmin4 when deserialization of untrusted data is triggered. Attackers gain admin access to PostgreSQL management UI on Linux servers — leading to database takeover.

Affected pgAdmin4

• pgAdmin4 before 8.11
• Docker and pip installs on Ubuntu, Debian, RHEL
• pgAdmin exposed on port 5050/443 without IP restriction

Check version

pip show pgadmin4 | grep Version
docker exec pgadmin4 cat /pgadmin4/version.json 2>/dev/null
curl -s http://127.0.0.1:5050/misc/ping

Patching Method

pip install on Linux

sudo systemctl stop pgadmin4
pip install --upgrade pgadmin4==8.11
sudo systemctl start pgadmin4

Docker

docker pull dpage/pgadmin4:8.11
docker compose down
docker compose up -d

1. After upgrade, reset pgAdmin master password and review stored server connections.
2. Rotate PostgreSQL passwords for all servers registered in pgAdmin.
3. Restrict pgAdmin to VPN or SSH tunnel — never public internet.

Post-patch audit

• Check pgAdmin user table for unknown admin accounts
• Review PostgreSQL logs for new superuser grants
• Enable 2FA if using pgAdmin 8.11+ with MFA support