CVE-2024-3116: pgAdmin validate binary path API command injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with public exploit code and a 9.8 CVSS score makes this an urgent patch target.

What it is

pgAdmin 8.4 and earlier expose a remote code execution flaw through the validate binary path API, which fails to safely handle input and allows command injection. Because the endpoint is reachable without authentication, any network attacker who can reach the pgAdmin service can run arbitrary code on the host. This is severe given pgAdmin's role managing PostgreSQL instances and the credentials it holds.

Impact

An attacker gains arbitrary code execution on the server hosting pgAdmin, with the privileges of the pgAdmin process. That can lead to compromise of managed database credentials, data, and the underlying host.

Attack surface

Reached over the network via the validate binary path API endpoint; the CVSS vector indicates no authentication and no user interaction are required. Any pgAdmin instance exposed to untrusted networks is directly at risk.

Exploitation

Not listed in CISA KEV, but EPSS is 0.65 (99th percentile) and multiple references are tagged Exploit, including public gists and the upstream issue, indicating working exploit code is publicly available.

What to do

• Upgrade pgAdmin to a version later than 8.4 that fixes the validate binary path API; apply the vendor patch first.
• If immediate upgrade is not possible, restrict network access to pgAdmin so only trusted administrative hosts can reach it.
• Do not expose pgAdmin directly to the internet; place it behind a VPN or authenticated reverse proxy.
• Run pgAdmin with least privilege and avoid storing high-value database credentials in the instance.
• Monitor Fedora package announcements for the corresponding updated package if pgAdmin is installed from distribution repositories.

Detection

• Review pgAdmin HTTP logs for requests to the validate binary path API endpoint, especially from unexpected source IPs.
• Alert on child processes spawned by the pgAdmin service, such as shells or unexpected binaries.
• Monitor for outbound connections from the pgAdmin host that do not match normal database or update traffic.
• Audit pgAdmin configuration and stored server credentials for signs of tampering after any suspicious API access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.