A critical vulnerability in pgAdmin 4 allows unauthenticated attackers to bypass TLS certificate verification during LDAP authentication, potentially exposing sensitive credentials.

The flaw resides in the LDAP authentication module, where the application fails to properly validate TLS certificates. This vulnerability is remotely exploitable by an unauthenticated attacker, allowing them to intercept or manipulate authentication traffic.

Successful exploitation of this flaw allows attackers to perform man-in-the-middle attacks during the authentication process, potentially leading to the compromise of administrative credentials. With a CVSS score of 7.5, this high-severity issue poses a significant risk to the integrity and confidentiality of database management operations. Unauthorized access to pgAdmin can result in full database compromise and unauthorized data exfiltration.

Immediate Action: Update pgAdmin 4 to version 9.10 or later to ensure the LDAP authentication mechanism correctly validates TLS certificates.

Proactive Monitoring: Review authentication and access logs for unusual LDAP connection patterns or unexpected certificate validation errors.

Compensating Controls: Ensure that network traffic for LDAP authentication is restricted to trusted paths and implement strict network segmentation to isolate the database administration interface.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the ability for an unauthenticated attacker to bypass security controls in the authentication pipeline, this vulnerability should be treated with high priority. Organizations utilizing LDAP for pgAdmin authentication must expedite the upgrade to version 9.10 to remediate this risk and prevent potential credential interception.