CVE-2026-116245: pgAdmin 4: Connection services are not restricted in server mode

Published Oct 30, 2026

Updated

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's Service, or a "service" connection parameter, to one of those entries and connect with its credentials. A PGPASSWORD or PGSERVICE variable set for that account was likewise used by libpq for every connection without a value of its own and passed on to the utilities, and pgdumpall read a maintenance database name such as "service=..." as a connection string.

The fix adds the SERVERMODEALLOWEDSERVICES setting, empty by default: in server mode only a listed service can be used, the servicefile parameter is refused, and PGPASSWORD and PGSERVICE are removed from pgAdmin's environment at startup. The allowlist is checked again on the final connection string, and the pgdumpall database name is wrapped as a connection string.

This issue affects pgAdmin 4: before 9.19.

Event History

Oct 30, 2026

CVE Published

via MITRE·07:55 PM

Data Sourced

via MITRE·07:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

pgAdmin 4 deployments running in server mode are affected if they use a version before 9.19. The issue depends on connection services or relevant libpq environment variables available to the operating-system account that runs pgAdmin.

What does an attacker need to exploit this?

An attacker needs access as a pgAdmin user who can set a server's Service field or provide a "service" connection parameter. They can then select a service entry available to the pgAdmin operating-system account and potentially connect using credentials stored or referenced by that entry.

Are default configurations affected?

The fixed SERVER_MODE_ALLOWED_SERVICES setting is empty by default, meaning no connection services are allowed in server mode unless explicitly listed. Before the fix, service use was not restricted in server mode, and PGPASSWORD or PGSERVICE set for the pgAdmin account could affect connections without their own values.

What can be done before upgrading?

Remove PGPASSWORD and PGSERVICE from the environment of the operating-system account running pgAdmin, and remove or protect service-file entries that contain or reference credentials. Restrict pgAdmin users from configuring Service or service connection parameters where possible.

How can administrators identify potential exposure?

Check whether pgAdmin runs in server mode and is older than 9.19. Inspect the pgAdmin service account's environment for PGPASSWORD or PGSERVICE and its libpq service file for entries containing passwords, password-file references, or client-certificate references.

CVE-2026-116245: pgAdmin 4: Connection services are not restricted in server mode

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

Are default configurations affected?

What can be done before upgrading?

How can administrators identify potential exposure?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

Are default configurations affected?

What can be done before upgrading?

How can administrators identify potential exposure?