CVE-2026-116246— pgAdmin 4: Server passwords are left in pgAdmin's process environment

Quick assessment

Affected

pgadmin.org pgAdmin 4

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

为了将服务器密码传递给以及 pgAdmin 4 作为后台进程运行的相关工具，服务器管理员将该密码写入了 pgAdmin 自身的进程环境变量中：对于工具，使用变量；对于其他工具，则使用每个进程特有的环境变量。此后，该密码并未被清除。由于 pgAdmin 的环境变量对所有用户的请求共享，且会被复制到其启动的每一个进程中，因此在服务器模式下，后续其他用户发起的会话或工具调用会继承该密码。而库在建立未提供独立密码的连接时，会使用环境变量，从而导致一名用户能够使用另一名用户保存的密码进行连接。修复方案是将密码仅

CVSS 6.5 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1552 · Unsecured Credentials

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

pgAdmin 4: Server passwords are left in pgAdmin's process environment

Source: CVE Program / CVE List V5

Vulnerability Description

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environment is shared by every user's requests and copied into every process it starts, so in server mode another user's later PSQL session or utility inherited the password, and libpq used PGPASSWORD for any connection made without a password of its own, letting one user connect with another user's saved password. The fix puts the password only into the environment built for the process that needs it and starts psql with a copy of pgAdmin's environment instead of the environment itself. This issue affects pgAdmin 4: before 9.19.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过处理环境导致的信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pgadmin.org	pgAdmin 4	0 ~ 9.19	-

II. Public POCs for CVE-2026-116246

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116246

请登录查看更多情报信息。

Other References for CVE-2026-116246 (2)

https://www.cve.org/CVERecord?id=CVE-2026-116246

Same Patch Batch · pgadmin.org · 2026-10-30 · 15 CVEs total

CVE-2026-116241	9.9 CRITICAL	pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-
CVE-2026-116239	8.5 HIGH	pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernam
CVE-2026-116249	8.4 HIGH	pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
CVE-2026-116247	8.2 HIGH	pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certifica
CVE-2026-116245	8.2 HIGH	pgAdmin 4: Connection services are not restricted in server mode
CVE-2026-116242	8.2 HIGH	pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
CVE-2026-116244	8.2 HIGH	pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
CVE-2026-116238	8.1 HIGH	pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgA
CVE-2026-116243	7.5 HIGH	pgAdmin 4: Utility binary path can point at a shared storage directory
CVE-2026-116248	6.8 MEDIUM	pgAdmin 4: Non-administrators can share a server with every user
CVE-2026-116252	6.5 MEDIUM	pgAdmin 4: Materialized view refresh redirects its connection through a crafted database n
CVE-2026-116250	6.5 MEDIUM	pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO p
CVE-2026-116240	6.5 MEDIUM	pgAdmin 4: File Manager and storage-path tools act on a different path from the one checke
CVE-2026-116251	4.2 MEDIUM	pgAdmin 4: A user's other sessions survive a change of their password

IV. Related Vulnerabilities

Same product: pgAdmin 4

Same vendor: pgadmin.org

Same weakness: CWE-214