pgAdmin 4: Server passwords are left in pgAdmin's process environment
Summary
| CVE | CVE-2026-116246 |
|---|---|
| State | PUBLISHED |
| Assigner | PostgreSQL |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-30 20:17:04 UTC |
| Updated | 2026-10-30 20:17:04 UTC |
| Description | To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environment is shared by every user's requests and copied into every process it starts, so in server mode another user's later PSQL session or utility inherited the password, and libpq used PGPASSWORD for any connection made without a password of its own, letting one user connect with another user's saved password. The fix puts the password only into the environment built for the process that needs it and starts psql with a copy of pgAdmin's environment instead of the environment itself. This issue affects pgAdmin 4: before 9.19. |
Risk And Classification
Primary CVSS: v4.0 7 HIGH from f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-214 | CWE-526 | CWE-214 CWE-214 Invocation of Process Using Visible Sensitive Information | CWE-526 CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | Secondary | 7 | HIGH | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7 | HIGH | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N |
| 3.1 | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N |
| 3.1 | CNA | CVSS | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Pgadmin.org | PgAdmin 4 | affected 9.19 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/pgadmin-org/pgadmin4/issues/10653 | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | github.com | |
| github.com/pgadmin-org/pgadmin4/commit/0eefa38f774dce07c1f939d87f2993b36... | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Dave Page <[email protected]> (en)
CNA: Kundan Sable <[email protected]> (en)
CNA: Ashesh Vashi <[email protected]> (en)