Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116239— pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username

Quick assessment

Affected
pgadmin.org pgAdmin 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在服务器模式下，pgAdmin 4 会为每个认证源维护独立的账户记录，因此同一用户名可能同时存在于不同的认证源中（例如，既作为内部账户存在，也作为 LDAP 账户存在）。当用户通过 LDAP 或 Kerberos 完成认证后，pgAdmin 仅凭用户名选择登录账户，或直接沿用 Flask-Security 登录表单查询到的账户，而未验证该账户是否源自实际完成认证的那个认证源。这导致会话被错误地关联到另一个账户，从而继承了该账户的角色、服务器列表以及已保存的数据库密码： 若某 LDAP 或 Kerberos 用户的用

CVSS 8.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116239

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username
Source: CVE Program / CVE List V5
Vulnerability Description
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's login form had looked up, without checking that it came from the source that authenticated the user. The session therefore belonged to another account, with its role, its servers and its saved database passwords: - An LDAP or Kerberos user whose username matched an internal account was logged in as that internal account, including the administrator account created when pgAdmin is first set up. - With internal authentication listed before LDAP or Kerberos in AUTHENTICATION_SOURCES, the login form's internal validation looks up the account whose email was typed and keeps it even though its password does not match. A Kerberos user could type another Kerberos user's principal and be logged in as that user, and an LDAP user could do the same with an LDAP account whose email is their username. Exploitation requires valid credentials for an LDAP directory or Kerberos realm that pgAdmin is configured to use. The fix looks the account up by the authenticated username and the source that authenticated it, and no longer uses the account the login form found for any source but internal authentication. Internal authentication logs in that account only if it is an internal account. Desktop mode is not affected. This issue affects pgAdmin 4: before 9.19.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pgadmin.org pgAdmin 4 0 ~ 9.19 -

II. Public POCs for CVE-2026-116239

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116239

请登录查看更多情报信息。

Other References for CVE-2026-116239 (3)

Same Patch Batch · pgadmin.org · 2026-10-30 · 15 CVEs total

CVE-2026-116241 9.9 CRITICAL pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-
CVE-2026-116249 8.4 HIGH pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
CVE-2026-116247 8.2 HIGH pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certifica
CVE-2026-116245 8.2 HIGH pgAdmin 4: Connection services are not restricted in server mode
CVE-2026-116242 8.2 HIGH pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
CVE-2026-116244 8.2 HIGH pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
CVE-2026-116238 8.1 HIGH pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgA
CVE-2026-116243 7.5 HIGH pgAdmin 4: Utility binary path can point at a shared storage directory
CVE-2026-116248 6.8 MEDIUM pgAdmin 4: Non-administrators can share a server with every user
CVE-2026-116252 6.5 MEDIUM pgAdmin 4: Materialized view refresh redirects its connection through a crafted database n
CVE-2026-116250 6.5 MEDIUM pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO p
CVE-2026-116246 6.5 MEDIUM pgAdmin 4: Server passwords are left in pgAdmin's process environment
CVE-2026-116240 6.5 MEDIUM pgAdmin 4: File Manager and storage-path tools act on a different path from the one checke
CVE-2026-116251 4.2 MEDIUM pgAdmin 4: A user's other sessions survive a change of their password

IV. Related Vulnerabilities

Same product: pgAdmin 4
Same vendor: pgadmin.org
Same weakness: CWE-287