Subject: pgAdmin 4 || vulnerable pip modules

From: Rogelio Villafana Sanchez <[email-masked]>
Date: Mon, 16 Feb 2026 19:40:00 +0000

Hello PGAdmin support team,

Three weeks ago, we completed the upgrade of PGAdmin to v9.11, yet in our last vulnerabilities scan report, several pip modules came in the picture as vulnerable version.
As these are modules which come embedded in the site packages installer, we would like to confirm below question with you.

  1.  Any existing/coming version that fix shared CVEs?
  2.  Will it be in their roadmap. If yes when is the plan to fix it?
  3.  Can we delete those files do we see any impact?
  4.  We can see v9.12 was just released, but does this version fix the CVEs or have the modules on fixed version?
  5.  Also, we know these CVEs might be false positive if yes, please share the description.

CVE-2025-68146
CVE-2025-68158
CVE-2025-69277
CVE-2026-0994
CVE-2026-21226
CVE-2026-21441
CVE-2026-21860
CVE-2026-22701
CVE-2026-22702
CVE-2026-23490
CVE-2026-23949
CVE-2026-24049
CVE-2026-26007

Rogelio Villafaña
DevOps Specialist | ATT BSSe
[Shape  Description automatically generated with medium confidence]

This email and the information contained herein is proprietary and confidential and subject to the Amdocs Email Terms of Service, which you may review at https://www.amdocs.com/about/email-terms-of-service <https://www.amdocs.com/about/email-terms-of-service>

---

From: Aditya Toshniwal <[email-masked]>
Date: Wed, 18 Feb 2026 11:05:45 +0530

Hi Rogelio,

I checked the CVE list you shared and the package versions required to fix
it. I then checked the pgAdmin venv for the actual installed versions and
found them all to be newer.
What did you use to scan the CVEs in pgAdmin?

*CVE ID* *Package* *Required Version (or newer)* *Primary Action*
*CVE-2025-68146* filelock *v3.17.0* Upgrade to prevent symlink-based file
corruption.
*CVE-2025-68158* Authlib *v1.4.1* Upgrade to ensure OAuth states are
strictly bound to user sessions.
*CVE-2025-69277* libsodium *v1.0.21* Update the underlying C library (often
via pynacl update).
*CVE-2026-0994* protobuf *v5.29.3* Upgrade to enforce stricter recursion
limits on nested messages.
*CVE-2026-21226* azure-core *v1.31.0* *Critical:* Upgrade immediately to
disable insecure deserialization.
*CVE-2026-21441* urllib3 *v2.3.1* Upgrade to fix "Decompression Bomb"
handling in redirects.
*CVE-2026-21860* Werkzeug *v3.1.4* Upgrade to properly sanitize Windows
reserved device names.
*CVE-2026-22701* filelock *v3.18.0* Upgrade to patch the SoftFileLock race
condition.
*CVE-2026-22702* virtualenv *v20.29.2* Upgrade to prevent symlink attacks
during environment creation.
*CVE-2026-23490* pyasn1 *v0.6.2* Upgrade to prevent memory exhaustion from
malformed OIDs.
*CVE-2026-23949* jaraco.context *v6.1.0* Upgrade to fix Path Traversal (Zip
Slip) in tarball().
*CVE-2026-24049* wheel *v0.45.2* Upgrade to prevent unauthorized chmod
calls during unpacking.
*CVE-2026-26007* cryptography *v44.0.2* *Critical:* Upgrade to ensure
validation of SECT curve points.

On Tue, Feb 17, 2026 at 9:18 PM Rogelio Villafana Sanchez <
[email-masked]> wrote:

> Three weeks ago, we completed the upgrade of PGAdmin to v9.11, yet in our
> last vulnerabilities scan report, several pip modules came in the picture
> as vulnerable version.
>
> As these are modules which come embedded in the site packages installer,
> we would like to confirm below question with you.
>
>
>
>    4. We can see v9.12 was just released, but does this version fix the
>    CVEs or have the modules on fixed version?
> *Rogelio Villafaña*
> *This email and the information contained herein is proprietary and
> confidential and subject to the Amdocs Email Terms of Service, which you
> may review at* *https://www.amdocs.com/about/email-terms-of-service*
> <https://www.amdocs.com/about/email-terms-of-service>
>

-- 
Thanks,
Aditya Toshniwal
pgAdmin Hacker | Sr. Staff SDE II | *enterprisedb.com*
<https://www.enterprisedb.com/>
"Don't Complain about Heat, Plant a TREE"

---

From: Rogelio Villafana Sanchez <[email-masked]>
Date: Wed, 18 Feb 2026 18:23:36 +0000

Hello @Chetan<mailto:[email-masked]>,

Could you help sharing the scan tool details used for the WIZ report?

Rogelio Villafaña

From: Aditya Toshniwal <[email-masked]>
Sent: Tuesday, February 17, 2026 11:36 PM
To: Rogelio Villafana Sanchez <[email-masked]>
Cc: [email-masked]; Akshay Swami <[email-masked]>; Manas . <[email-masked]>
Subject: Re: pgAdmin 4 || vulnerable pip modules

You don't often get email from [email-masked]<mailto:[email-masked]>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
CAUTION: This email is from an external source. Please don’t open any unknown links or attachments.
Hi Rogelio,

I checked the CVE list you shared and the package versions required to fix it. I then checked the pgAdmin venv for the actual installed versions and found them all to be newer.
What did you use to scan the CVEs in pgAdmin?

CVE ID
Package
Required Version (or newer)
Primary Action
CVE-2025-68146
filelock
v3.17.0
Upgrade to prevent symlink-based file corruption.
CVE-2025-68158
Authlib
v1.4.1
Upgrade to ensure OAuth states are strictly bound to user sessions.
CVE-2025-69277
libsodium
v1.0.21
Update the underlying C library (often via pynacl update).
CVE-2026-0994
protobuf
v5.29.3
Upgrade to enforce stricter recursion limits on nested messages.
CVE-2026-21226
azure-core
v1.31.0
Critical: Upgrade immediately to disable insecure deserialization.
CVE-2026-21441
urllib3
v2.3.1
Upgrade to fix "Decompression Bomb" handling in redirects.
CVE-2026-21860
Werkzeug
v3.1.4
Upgrade to properly sanitize Windows reserved device names.
CVE-2026-22701
filelock
v3.18.0
Upgrade to patch the SoftFileLock race condition.
CVE-2026-22702
virtualenv
v20.29.2
Upgrade to prevent symlink attacks during environment creation.
CVE-2026-23490
pyasn1
v0.6.2
Upgrade to prevent memory exhaustion from malformed OIDs.
CVE-2026-23949
jaraco.context
v6.1.0
Upgrade to fix Path Traversal (Zip Slip) in tarball().
CVE-2026-24049
wheel
v0.45.2
Upgrade to prevent unauthorized chmod calls during unpacking.
CVE-2026-26007
cryptography
v44.0.2
Critical: Upgrade to ensure validation of SECT curve points.

On Tue, Feb 17, 2026 at 9:18 PM Rogelio Villafana Sanchez <[email-masked]<mailto:[email-masked]>> wrote:
Hello PGAdmin support team,

CVE-2025-68146
CVE-2025-68158
CVE-2025-69277
CVE-2026-0994
CVE-2026-21226
CVE-2026-21441
CVE-2026-21860
CVE-2026-22701
CVE-2026-22702
CVE-2026-23490
CVE-2026-23949
CVE-2026-24049
CVE-2026-26007

Rogelio Villafaña

This email and the information contained herein is proprietary and confidential and subject to the Amdocs Email Terms of Service, which you may review at https://www.amdocs.com/about/email-terms-of-service

--
Thanks,
Aditya Toshniwal
pgAdmin Hacker | Sr. Staff SDE II | enterprisedb.com<https://www.enterprisedb.com/>
"Don't Complain about Heat, Plant a TREE"
This email and the information contained herein is proprietary and confidential and subject to the Amdocs Email Terms of Service, which you may review at https://www.amdocs.com/about/email-terms-of-service <https://www.amdocs.com/about/email-terms-of-service>

---

From: Chetan Lohi <[email-masked]>
Date: Thu, 19 Feb 2026 05:22:20 +0000

Hi Team,

Wiz itself does vulnerability scanning there is no additional tool involved.

Regards
Chetan Lohi

From: Rogelio Villafana Sanchez <[email-masked]>
Sent: Wednesday, February 18, 2026 11:54 PM
To: Aditya Toshniwal <[email-masked]>; Chetan Lohi <[email-masked]>
Cc: [email-masked]; Akshay Swami <[email-masked]>; Manas . <[email-masked]>
Subject: RE: pgAdmin 4 || vulnerable pip modules

Rogelio Villafaña

From: Aditya Toshniwal <[email-masked]<mailto:[email-masked]>>
Sent: Tuesday, February 17, 2026 11:36 PM
To: Rogelio Villafana Sanchez <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>; Akshay Swami <[email-masked]<mailto:[email-masked]>>; Manas . <[email-masked]<mailto:[email-masked]>>
Subject: Re: pgAdmin 4 || vulnerable pip modules

CVE ID
Package

CVE-2025-68146
CVE-2025-68158
CVE-2025-69277
CVE-2026-0994
CVE-2026-21226
CVE-2026-21441
CVE-2026-21860
CVE-2026-22701
CVE-2026-22702
CVE-2026-23490
CVE-2026-23949
CVE-2026-24049
CVE-2026-26007

Rogelio Villafaña

--
Thanks,
Aditya Toshniwal
pgAdmin Hacker | Sr. Staff SDE II | enterprisedb.com<https://www.enterprisedb.com/>
"Don't Complain about Heat, Plant a TREE"
This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>

Amdocs Development Centre India Private Limited having CIN: U72200PN2004PTC0188320 converted into Amdocs Development Centre India LLP (A limited liability partnership with LLP Identification Number: AAI-6901 effective 28th Feb 2017)

---

From: Rogelio Villafana Sanchez <[email-masked]>
Date: Thu, 19 Feb 2026 15:05:28 +0000

Thanks, Chetan!

Hi @Aditya Toshniwal<mailto:[email-masked]>, the only tool used its WIZ.

Rogelio Villafaña

From: Chetan Lohi <[email-masked]>
Sent: Wednesday, February 18, 2026 11:22 PM
To: Rogelio Villafana Sanchez <[email-masked]>; Aditya Toshniwal <[email-masked]>
Cc: [email-masked]; Akshay Swami <[email-masked]>; Manas . <[email-masked]>
Subject: RE: pgAdmin 4 || vulnerable pip modules

Hi Team,

Regards
Chetan Lohi

From: Rogelio Villafana Sanchez <[email-masked]<mailto:[email-masked]>>
Sent: Wednesday, February 18, 2026 11:54 PM
To: Aditya Toshniwal <[email-masked]<mailto:[email-masked]>>; Chetan Lohi <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>; Akshay Swami <[email-masked]<mailto:[email-masked]>>; Manas . <[email-masked]<mailto:[email-masked]>>
Subject: RE: pgAdmin 4 || vulnerable pip modules

Rogelio Villafaña

CVE ID
Package

CVE-2025-68146
CVE-2025-68158
CVE-2025-69277
CVE-2026-0994
CVE-2026-21226
CVE-2026-21441
CVE-2026-21860
CVE-2026-22701
CVE-2026-22702
CVE-2026-23490
CVE-2026-23949
CVE-2026-24049
CVE-2026-26007

Rogelio Villafaña

---

From: Aditya Toshniwal <[email-masked]>
Date: Mon, 23 Feb 2026 14:37:35 +0530

Hi Rogelio,

We've already checked the mentioned CVEs in the latest version. I'm not
sure how WIZ works.

On Thu, Feb 19, 2026 at 8:35 PM Rogelio Villafana Sanchez <
[email-masked]> wrote:

> Thanks, Chetan!
>
>
>
> Hi @Aditya Toshniwal <[email-masked]>, the only tool
> used its WIZ.
>
>
>
>
>
> *Rogelio Villafaña*
>
> *From:* Chetan Lohi <[email-masked]>
> *Sent:* Wednesday, February 18, 2026 11:22 PM
> *To:* Rogelio Villafana Sanchez <[email-masked]>; Aditya
> Toshniwal <[email-masked]>
> *Cc:* [email-masked]; Akshay Swami <
> [email-masked]>; Manas . <[email-masked]>
> *Subject:* RE: pgAdmin 4 || vulnerable pip modules
>
>
>
> Hi Team,
>
>
>
> *From:* Rogelio Villafana Sanchez <[email-masked]>
> *Sent:* Wednesday, February 18, 2026 11:54 PM
> *To:* Aditya Toshniwal <[email-masked]>; Chetan Lohi <
> [email-masked]>
> *Cc:* [email-masked]; Akshay Swami <
> [email-masked]>; Manas . <[email-masked]>
> *Subject:* RE: pgAdmin 4 || vulnerable pip modules
>
>
>
> Hello @Chetan <[email-masked]>,
>
>
>
> *From:* Aditya Toshniwal <[email-masked]>
> *Sent:* Tuesday, February 17, 2026 11:36 PM
> *To:* Rogelio Villafana Sanchez <[email-masked]>
> *Cc:* [email-masked]; Akshay Swami <
> [email-masked]>; Manas . <[email-masked]>
> *Subject:* Re: pgAdmin 4 || vulnerable pip modules
>
>
>
> You don't often get email from [email-masked]. Learn
> why this is important <https://aka.ms/LearnAboutSenderIdentification>
>
> *CAUTION:* This email is from an external source. Please don’t open any
> unknown links or attachments.
>
> Hi Rogelio,
>
>
>
> *CVE ID*
> *Package*
> *Required Version (or newer)*
>
> *Primary Action*
>
> *CVE-2025-68146*
>
> filelock
>
> *v3.17.0*
>
> *CVE-2025-68158*
> *v1.4.1*
> *CVE-2025-69277*
> *v1.0.21*
> *CVE-2026-0994*
> *v5.29.3*
> *CVE-2026-21226*
> *v1.31.0*
> *Critical:* Upgrade immediately to disable insecure deserialization.
>
> *CVE-2026-21441*
>
> urllib3
>
> *v2.3.1*
>
> *CVE-2026-21860*
> *v3.1.4*
> *CVE-2026-22701*
> *v3.18.0*
> *CVE-2026-22702*
> *v20.29.2*
> *CVE-2026-23490*
> *v0.6.2*
> *CVE-2026-23949*
> *v6.1.0*
> *CVE-2026-24049*
> *v0.45.2*
> *CVE-2026-26007*
> *v44.0.2*
> *Critical:* Upgrade to ensure validation of SECT curve points.
>
>
>

---

From: Rogelio Villafana Sanchez <[email-masked]>
Date: Mon, 23 Feb 2026 19:32:24 +0000

Hello @Aditya<mailto:[email-masked]>,

Means all mentioned CVEs are fixed on specific PgAdmin version?

Rogelio Villafaña

From: Aditya Toshniwal <[email-masked]>
Sent: Monday, February 23, 2026 3:08 AM
To: Rogelio Villafana Sanchez <[email-masked]>
Cc: Chetan Lohi <[email-masked]>; [email-masked]; Akshay Swami <[email-masked]>; Manas . <[email-masked]>
Subject: Re: pgAdmin 4 || vulnerable pip modules

We've already checked the mentioned CVEs in the latest version. I'm not sure how WIZ works.

On Thu, Feb 19, 2026 at 8:35 PM Rogelio Villafana Sanchez <[email-masked]<mailto:[email-masked]>> wrote:
Thanks, Chetan!

Rogelio Villafaña

From: Chetan Lohi <[email-masked]<mailto:[email-masked]>>
Sent: Wednesday, February 18, 2026 11:22 PM
To: Rogelio Villafana Sanchez <[email-masked]<mailto:[email-masked]>>; Aditya Toshniwal <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>; Akshay Swami <[email-masked]<mailto:[email-masked]>>; Manas . <[email-masked]<mailto:[email-masked]>>
Subject: RE: pgAdmin 4 || vulnerable pip modules

Hi Team,

Regards
Chetan Lohi

Rogelio Villafaña

CVE ID
Package

CVE-2025-68146
CVE-2025-68158
CVE-2025-69277
CVE-2026-0994
CVE-2026-21226
CVE-2026-21441
CVE-2026-21860
CVE-2026-22701
CVE-2026-22702
CVE-2026-23490
CVE-2026-23949
CVE-2026-24049
CVE-2026-26007

Rogelio Villafaña

---

From: Aditya Toshniwal <[email-masked]>
Date: Tue, 24 Feb 2026 10:26:27 +0530

Hi Rogelio,

I didn't find any.

On Tue, Feb 24, 2026 at 1:02 AM Rogelio Villafana Sanchez <
[email-masked]> wrote:

> Hello @Aditya <[email-masked]>,
>
>
>
> *Sent:* Monday, February 23, 2026 3:08 AM
> *Cc:* Chetan Lohi <[email-masked]>;
> [email-masked]; Akshay Swami <[email-masked]>;
> Manas . <[email-masked]>