CyberSecBulletin
CVE-2026-116245NVD status: Analyzed

pgAdmin 4: Insufficiently Protected Credentials

Published Updated By the CyberSecBulletin desk

CVE-2026-116245 is a critical-severity insufficiently protected credentials vulnerability in pgAdmin 4 from Pgadmin.org, with a CVSS 3.1 base score of 9.6 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists version 9.19 as the first without the flaw, so updating pgAdmin 4 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update pgAdmin 4 to 9.19 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
Pgadmin.orgpgAdmin 4before 9.199.19

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.07.1HighCNA
CVSS 3.18.2HighCNA
CVSS 3.19.6CriticalNVD

Official description

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's Service, or a "service" connection parameter, to one of those entries and connect with its credentials. A PGPASSWORD or PGSERVICE variable set for that account was likewise used by libpq for every connection without a value of its own and passed on to the utilities, and pg_dumpall read a maintenance database name such as "service=..." as a connection string. The fix adds the SERVER_MODE_ALLOWED_SERVICES setting, empty by default: in server mode only a listed service can be used, the servicefile parameter is refused, and PGPASSWORD and PGSERVICE are removed from pgAdmin's environment at startup. The allowlist is checked again on the final connection string, and the pg_dumpall database name is wrapped as a connection string. This issue affects pgAdmin 4: before 9.19.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

How developers prevent this class of flaw

  • Use an appropriate security mechanism to protect the credentials.
  • Make appropriate use of cryptography to protect the credentials.
  • Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

More Insufficiently Protected Credentials vulnerabilities (CWE-522)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other references

Other vulnerabilities in pgAdmin 4

All pgAdmin 4 vulnerabilities

Recent Insufficiently Protected Credentials vulnerabilities

Spotted an error? Tell us.