CVE-2026-116252

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the host, port and other settings pgAdmin had supplied. A database whose name is such a string, which any role with CREATEDB can create, therefore redirected the psql process pgAdmin starts for the refresh to a host and port of the creator's choosing, and the connecting user's saved server password was presented to that endpoint. It also let the pgAdmin host be made to open connections to arbitrary addresses. The same weakness was fixed for Backup, Restore, Maintenance and Import/Export Data in earlier releases (CVE-2026-86862); the materialized view refresh was the remaining caller. The fix routes the name through the same database_conninfo() helper, so libpq treats it strictly as a database name. This issue affects pgAdmin 4: before 9.19.

• CWE-88
• CWE-522
• CWE-918

• https://github.com/pgadmin-org/pgadmin4/commit/a1a43e8c28cf10cec73df0c476905562d19af483
• https://github.com/pgadmin-org/pgadmin4/issues/10645

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116247When a server in pgAdmin 4 had no password file, client cert…8.2
• CVE-2026-116248In pgAdmin 4 server mode only administrators are meant to sh…6.8
• CVE-2026-116249In server mode pgAdmin 4 resolves a server's password file, …8.4
• CVE-2026-11625Bytes::Random::Secure versions through 0.29 for Perl share i…7.5
• CVE-2026-116250In server mode pgAdmin 4 validates a path a user gives for a…6.5
• CVE-2026-116251pgAdmin 4 did not invalidate a user's existing sessions when…4.2
• CVE-2026-116253A vulnerability was determined in DedeCMS 5.7.118. This vuln…7.3
• CVE-2026-116254A vulnerability was identified in rathena FluxCP up to 98cd4…6.5
• CVE-2026-116255A vulnerability has been found in PGYER codefever up to 0c35…5.3
• CVE-2026-116256A vulnerability was found in geesondog RhaPHP up to 7ae639cc…7.3
• CVE-2026-116257A vulnerability was determined in BillaBear up to 2025.01.03…7.3
• CVE-2026-116258A vulnerability was identified in libimobiledevice up to 1.4…6.3