pgAdmin CVE-2025-12765

pgAdmin must be configured to use LDAP as an authentication source with TLS (LDAPS or StartTLS). The attacker must hold a man-in-the-middle / on-path position between the pgAdmin server and the LDAP server to substitute a rogue directory endpoint - this network-position requirement is the primary limiter and is why CVSS assigns AC:H. Deployments using pgAdmin's internal/local authentication (the default) or without an interceptable network path are not exploitable. No user interaction or prior authentication is required once the MITM position is held.

This is a genuine but conditionally-exploitable weakness rather than an urgent widespread threat. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4 High) tells a consistent story: exploitation is network-reachable and requires no authentication or user interaction, but AC:H reflects a meaningful precondition - the attacker must occupy an on-path/man-in-the-middle position between pgAdmin and the LDAP server, since the flaw (CWE-295) is failure to verify the LDAP server's TLS certificate. All signals point away from imminent mass exploitation: EPSS is 0.05% (16th percentile), the CVE is not in CISA KEV, and no public exploit code is referenced. Therefore this is 'no public exploit identified at time of analysis.' The impact is high (C:H/I:H) because a successful MITM lets an attacker impersonate the LDAP directory to harvest credentials or authenticate as an arbitrary pgAdmin user, but the AC:H MITM requirement plus the need for LDAP auth to be configured make this a targeted-scenario issue, not a spray-and-pray one. No signal conflict: the low EPSS/absent-KEV status is fully consistent with the high complexity of the attack.

An attacker positioned on the network path between the pgAdmin server and its LDAP/Active Directory server (e.g., via ARP spoofing on a shared segment or DNS/route manipulation) presents a rogue LDAP endpoint with an invalid or self-signed TLS certificate. Because pgAdmin <= 9.9 does not verify the certificate, the connection succeeds and the attacker either captures the credentials pgAdmin forwards or returns a forged 'authentication success' to log in as a chosen user. No public proof-of-concept is referenced, and the man-in-the-middle requirement (AC:H) raises the practical bar.