CVE-2026-116249

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but get_complete_file_path() only stripped leading slashes before joining the two. A path such as "../<another user>/.pgpass", set through the server dialog, the REST API or a servers.json import, therefore named another user's file, and connecting used that user's saved passwords, client certificate or SSH key. The sslkeylogfile connection parameter was passed to libpq unchanged, so a path outside storage let libpq create or append a file as the account running pgAdmin. make_conninfo() also quoted connection parameter values but not their names, so a crafted parameter name could smuggle additional keyword=value pairs past these checks. The fix requires the resolved path, with symbolic links followed, to stay inside the user's storage directory or the named shared storage directory, confines sslkeylogfile the same way, and accepts only exact libpq keywords as connection parameter names. A refused path or keyword is reported instead of letting libpq fall back to a default. This issue affects pgAdmin 4: before 9.19.

• CWE-22
• CWE-73

• https://github.com/pgadmin-org/pgadmin4/commit/2afe505ef4a31591796449d54ab1604355ff06c2
• https://github.com/pgadmin-org/pgadmin4/issues/10650

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116243pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from…7.5
• CVE-2026-116244When a pgAdmin 4 connection was not meant to use a Kerberos …8.2
• CVE-2026-116245libpq looks a connection service up in the service file of t…8.2
• CVE-2026-116246To pass a server's password to psql and to the utilities pgA…6.5
• CVE-2026-116247When a server in pgAdmin 4 had no password file, client cert…8.2
• CVE-2026-116248In pgAdmin 4 server mode only administrators are meant to sh…6.8
• CVE-2026-11625Bytes::Random::Secure versions through 0.29 for Perl share i…7.5
• CVE-2026-116250In server mode pgAdmin 4 validates a path a user gives for a…6.5
• CVE-2026-116251pgAdmin 4 did not invalidate a user's existing sessions when…4.2
• CVE-2026-116252pgAdmin 4's materialized view refresh passed the target data…6.5
• CVE-2026-116253A vulnerability was determined in DedeCMS 5.7.118. This vuln…7.3
• CVE-2026-116254A vulnerability was identified in rathena FluxCP up to 98cd4…6.5