Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2026-116247: pgAdmin 4 may let users access service account passwords
CVE-2026-116247 · published 5 days ago
Summary
In pgAdmin 4 versions before 9.19, if a server connection lacks its own password file or client certificate, the program falls back to using the service account’s default files. This can allow any user of the pgAdmin web interface to connect to databases using those saved credentials. Update pgAdmin to version 9.19 or later to stop this behavior.
What to do
- Update pgadmin.org pgadmin 4 to version 9.19 or later.
- Update pgadmin pgadmin_4 to version 9.19 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| pgadmin.org | pgadmin 4 | < 9.19 |
| pgadmin | pgadmin_4 |
< 9.19 cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:*:*:* |
Original advisory text
pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate
When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running pgAdmin: ~/.pgpass, ~/.postgresql/postgresql.crt and postgresql.key, or PGPASSFILE, PGSSLCERT and PGSSLKEY. In server mode any user could therefore connect to a server with the service account's saved passwords or client certificate, and supplying only a copy of its public certificate was enough for libpq to pair it with the service account's private key. A pg_service.conf entry, or a maintenance database name read as a connection string by pg_dumpall, could bring the same files back for the utilities.
The fix gives each of these parameters a value in server mode, the user's own file or otherwise a path that can never be opened, in the connection string, in the environment of the utilities and in the --dbname connection string that ranks above a service entry. Desktop mode is unchanged.
This issue affects pgAdmin 4: before 9.19.
The fix gives each of these parameters a value in server mode, the user's own file or otherwise a path that can never be opened, in the connection string, in the environment of the utilities and in the --dbname connection string that ranks above a service entry. Desktop mode is unchanged.
This issue affects pgAdmin 4: before 9.19.
References
- https://github.com/pgadmin-org/pgadmin4/issues/10652 Issue Tracking
- https://github.com/pgadmin-org/pgadmin4/commit/32db693198f28b78fe2af12a726b80a68... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-1162... Vendor Advisory
- https://github.com/pgadmin-org/pgadmin4 Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-116247 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-522Insufficiently Protected Credentials
CWE-1188Initialization of a Resource with an Insecure Default
Timeline
Published30 Oct 2026
Updated4 Nov 2026
First seen30 Oct 2026
Track software like this
Free during beta