CVE-2026-116242: pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity

Published Oct 30, 2026

Updated

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither hostpkeydirectories nor sshconfigfile, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that account's ~/.ssh/config (IdentityFile, User, HostName, ProxyCommand) for the tunnel host, and could use its ssh-agent. In server mode any user could therefore configure a tunnel to a host that accepts the service account's key, with no credentials of their own or with an identity file that did not exist in their storage, and reach it as that account.

The fix makes tunnels in server mode use only the identity file or password the user configured: the service account's keys, configuration and agent are no longer used, and an identity file that cannot be found in the user's storage is reported instead of falling back to ~/.ssh. Desktop mode is unchanged.

This issue affects pgAdmin 4: before 9.19.

Event History

Oct 30, 2026

CVE Published

via MITRE·07:55 PM

Data Sourced

via MITRE·07:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments of pgAdmin 4 in server mode before 9.19 are affected. Desktop mode is unchanged and is not identified as affected by this issue.

What does an attacker need to exploit it?

A pgAdmin server-mode user needs to be able to configure an SSH tunnel to a host that accepts the operating-system account running pgAdmin's SSH key. The user does not need to provide their own valid SSH credentials and may specify an identity file that is absent from their storage.

What service-account resources could be used by a vulnerable tunnel?

The tunnel could load unencrypted private keys from the pgAdmin service account's ~/.ssh directory, read that account's ~/.ssh/config settings, and use its SSH agent. Configuration directives including IdentityFile, User, HostName, and ProxyCommand could influence the connection.

What can be done if upgrading immediately is not possible?

The provided data does not specify a workaround. Risk is tied to server-mode access to the pgAdmin service account's SSH keys, SSH configuration, and agent, so these resources should not be available to vulnerable pgAdmin tunnel processes where possible.

How can I determine whether an instance is affected?

Check whether pgAdmin is running in server mode and is a version before 9.19. Also determine whether the operating-system account running pgAdmin has unencrypted keys in ~/.ssh, an SSH configuration file, or access to an SSH agent that could authenticate to tunnel destinations.

CVE-2026-116242: pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What service-account resources could be used by a vulnerable tunnel?

What can be done if upgrading immediately is not possible?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What service-account resources could be used by a vulnerable tunnel?

What can be done if upgrading immediately is not possible?

How can I determine whether an instance is affected?