CVE-2026-116246

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environment is shared by every user's requests and copied into every process it starts, so in server mode another user's later PSQL session or utility inherited the password, and libpq used PGPASSWORD for any connection made without a password of its own, letting one user connect with another user's saved password. The fix puts the password only into the environment built for the process that needs it and starts psql with a copy of pgAdmin's environment instead of the environment itself. This issue affects pgAdmin 4: before 9.19.

• CWE-214
• CWE-526

• https://github.com/pgadmin-org/pgadmin4/commit/0eefa38f774dce07c1f939d87f2993b36e2313b9
• https://github.com/pgadmin-org/pgadmin4/issues/10653

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116240In server mode pgAdmin 4 validates a path into the user's st…6.5
• CVE-2026-116241pgAdmin 4's Import/Export Data tool wraps a user's query exp…9.9
• CVE-2026-116242pgAdmin 4 opens SSH tunnels with the sshtunnel library but g…8.2
• CVE-2026-116243pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from…7.5
• CVE-2026-116244When a pgAdmin 4 connection was not meant to use a Kerberos …8.2
• CVE-2026-116245libpq looks a connection service up in the service file of t…8.2
• CVE-2026-116247When a server in pgAdmin 4 had no password file, client cert…8.2
• CVE-2026-116248In pgAdmin 4 server mode only administrators are meant to sh…6.8
• CVE-2026-116249In server mode pgAdmin 4 resolves a server's password file, …8.4
• CVE-2026-11625Bytes::Random::Secure versions through 0.29 for Perl share i…7.5
• CVE-2026-116250In server mode pgAdmin 4 validates a path a user gives for a…6.5
• CVE-2026-116251pgAdmin 4 did not invalidate a user's existing sessions when…4.2