{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-116247","assignerOrgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","state":"PUBLISHED","assignerShortName":"PostgreSQL","dateReserved":"2026-10-25T16:26:16.419Z","datePublished":"2026-10-30T19:55:16.935Z","dateUpdated":"2026-10-30T19:55:16.935Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","shortName":"PostgreSQL","dateUpdated":"2026-10-30T19:55:16.935Z"},"title":"pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate","datePublic":"2026-10-29T00:00:00.000Z","affected":[{"vendor":"pgadmin.org","product":"pgAdmin 4","repo":"https://github.com/pgadmin-org/pgadmin4","modules":["Servers","Backup","Restore","Import/Export Data","Maintenance","PSQL Tool"],"programFiles":["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py","https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/__init__.py"],"versions":[{"status":"affected","version":"0","lessThan":"9.19","versionType":"custom"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running pgAdmin: ~/.pgpass, ~/.postgresql/postgresql.crt and postgresql.key, or PGPASSFILE, PGSSLCERT and PGSSLKEY. In server mode any user could therefore connect to a server with the service account's saved passwords or client certificate, and supplying only a copy of its public certificate was enough for libpq to pair it with the service account's private key. A pg_service.conf entry, or a maintenance database name read as a connection string by pg_dumpall, could bring the same files back for the utilities.\n\nThe fix gives each of these parameters a value in server mode, the user's own file or otherwise a path that can never be opened, in the connection string, in the environment of the utilities and in the --dbname connection string that ranks above a service entry. Desktop mode is unchanged.\n\nThis issue affects pgAdmin 4: before 9.19."}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/10652","tags":["issue-tracking"]},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/32db693198f28b78fe2af12a726b80a68eb78cb2","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"Any authenticated user who can register a server. Attack Complexity is High: the service account must have a password file entry or client certificate that a server the attacker can reach accepts, a deployment condition the attacker does not control. Scope is Changed because the connection is made with the service account's database credentials, an identity the attacker was never granted; Confidentiality and Integrity are High on that database server. Availability is None."}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":8.2,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"Same reasoning as the CVSS 3.1 entry. AT:P for the service account's credential and an accepting server. VC:H because the service account's stored secret is used through pgAdmin; SC:H/SI:H for the database server reached with that identity."}],"cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N","baseScore":7.1,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-522 Insufficiently Protected Credentials","cweId":"CWE-522","type":"CWE"},{"lang":"en","description":"CWE-1188 Initialization of a Resource with an Insecure Default","cweId":"CWE-1188","type":"CWE"}]}],"credits":[{"lang":"en","value":"Dave Page <dpage@pgadmin.org>","type":"remediation developer"},{"lang":"en","value":"Kundan Sable <kundan.sable@enterprisedb.com>","type":"remediation reviewer"},{"lang":"en","value":"Ashesh Vashi <ashesh.vashi@enterprisedb.com>","type":"remediation reviewer"}],"source":{"discovery":"INTERNAL"}}}}