CVE-2025-12765: 
Python vulnerability analysis and mitigation

CVE-2025-12765 is a TLS certificate verification bypass vulnerability in the LDAP authentication mechanism of pgAdmin 4. It affects all versions up to and including 9.9, with version 9.10 containing the fix. The vulnerability was reported by security researcher Arad Inbar, disclosed on November 5, 2025, and published to the NVD and GitHub Advisory Database on November 13, 2025. It carries a CVSS v3.1 base score of 7.4–7.5 (High), depending on the scoring source (Github Advisory, pgAdmin Issue).

The root cause is CWE-295 (Improper Certificate Validation): the LDAP TLS client in pgAdmin proceeds without validating the server certificate unless a CA certificate, client certificate, and client key are all simultaneously configured. When only a CA certificate is provided — or none at all — certificate validation remains disabled, causing pgAdmin to accept any presented certificate, including self-signed or invalid ones. This is particularly impactful in Active Directory environments where mutual TLS (MTLS) is typically not enforced, leaving the LDAP bind credentials exposed to interception. The fix was introduced in commit 09d2b7e in the pgadmin4 repository (Github Advisory, pgAdmin Issue).

An on-path attacker can terminate the TLS connection using a bogus certificate and proxy LDAP traffic, stealing LDAP bind credentials (usernames and passwords) and potentially altering directory responses. Compromised LDAP credentials can enable unauthorized access to PostgreSQL databases managed through pgAdmin, and may facilitate lateral movement within the network if the same credentials are reused elsewhere. Availability is not directly impacted, but confidentiality and integrity of authentication data are both at high risk (pgAdmin Issue, Github Advisory).

1. Reconnaissance: Identify pgAdmin instances (version ≤ 9.9) configured to use LDAP authentication with TLS, particularly in environments using Active Directory where MTLS is typically disabled.
2. Network Positioning: Gain a man-in-the-middle position on the network path between the pgAdmin server and the LDAP/Active Directory server using ARP spoofing (same VLAN), DHCP spoofing/rogue gateway, or a Wi-Fi evil twin access point.
3. TLS Interception: Deploy a TLS-intercepting proxy (e.g., mitmproxy, Burp Suite, or a custom tool) presenting a self-signed or otherwise invalid certificate for the LDAP server. Because pgAdmin does not validate the server certificate in the affected configuration, the TLS handshake completes successfully.
4. Credential Capture: Intercept the LDAP bind request transmitted over the now-decrypted TLS channel, capturing plaintext LDAP credentials (distinguished name and password).
5. Exploitation: Use the captured credentials to authenticate directly to the LDAP/Active Directory server or to pgAdmin, gaining unauthorized access to managed PostgreSQL databases or broader directory resources (pgAdmin Issue, Github Advisory).

• Network: Unexpected ARP replies or ARP cache poisoning events on the network segment between the pgAdmin server and the LDAP server; unusual TLS certificates presented to the pgAdmin server during LDAP connections (e.g., self-signed certs from unexpected issuers); rogue DHCP server activity on the network.
• Logs: pgAdmin authentication logs showing successful LDAP logins from unexpected IP addresses or at unusual times; LDAP server logs showing bind requests originating from an unexpected intermediate IP rather than the pgAdmin server's IP.
• Network: Unexpected outbound LDAP (port 389/636) connections from the pgAdmin host to IP addresses not matching the configured LDAP server; duplicate IP-to-MAC mappings detected by network monitoring tools.

Upgrade pgAdmin 4 to version 9.10 or later, which contains the fix for this vulnerability (Github Advisory, pgAdmin Release). As a workaround prior to patching, configure pgAdmin's LDAP settings with a valid CA certificate, client certificate, and client key simultaneously to enable certificate validation. Additionally, enforce network-level controls such as dynamic ARP inspection (DAI), DHCP snooping, and 802.1X port authentication to reduce the risk of MITM attacks on the LDAP communication path (pgAdmin Issue).

The Belgium Centre for Cybersecurity (CCB) issued an advisory referencing this vulnerability alongside other PostgreSQL-related issues, urging immediate patching. Security community members noted the vulnerability on Mastodon (infosec.exchange), and it was covered in weekly threat landscape digests. The pgAdmin project addressed the issue promptly, releasing version 9.10 with the fix shortly after disclosure (CCB Advisory, pgAdmin Release).