CVE-2026-116252: pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name

Published Oct 30, 2026

Updated

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the host, port and other settings pgAdmin had supplied. A database whose name is such a string, which any role with CREATEDB can create, therefore redirected the psql process pgAdmin starts for the refresh to a host and port of the creator's choosing, and the connecting user's saved server password was presented to that endpoint. It also let the pgAdmin host be made to open connections to arbitrary addresses.

The same weakness was fixed for Backup, Restore, Maintenance and Import/Export Data in earlier releases (CVE-2026-86862); the materialized view refresh was the remaining caller. The fix routes the name through the same databaseconninfo() helper, so libpq treats it strictly as a database name.

This issue affects pgAdmin 4: before 9.19.

Event History

Oct 30, 2026

CVE Published

via MITRE·07:55 PM

Data Sourced

via MITRE·07:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can trigger the connection redirection?

A role that can create databases can create a database with a crafted name containing connection-string syntax or a postgresql:// URI. A user then has to refresh a materialized view in that database through pgAdmin for pgAdmin to launch the redirected psql connection.

What information or access can an attacker obtain?

The attacker can cause the pgAdmin host to connect to an address and port they choose. The saved password for the server connection used by the pgAdmin user is presented to the redirected endpoint.

Are installations affected by default?

The issue affects pgAdmin 4 versions before 9.19, but exploitation requires a crafted database name created by a role with CREATEDB and a materialized-view refresh performed through pgAdmin. The provided information does not establish whether CREATEDB is granted by default in a particular deployment.

What can be done before upgrading?

Restrict CREATEDB to trusted roles and avoid refreshing materialized views through pgAdmin in databases whose names may be attacker-controlled. Review database names for values containing '=' or postgresql:// and treat such names as suspicious.

CVE-2026-116252: pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name

Event History

Frequently Asked Questions

Who can trigger the connection redirection?

What information or access can an attacker obtain?

Are installations affected by default?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the connection redirection?

What information or access can an attacker obtain?

Are installations affected by default?

What can be done before upgrading?