# CVE-2026-116239: pgAdmin 4 authentication source confusion leading to account takeover

Source: https://junglewise.ai/threats/cve-2026-116239-in-server-mode-pgadmin-4-keeps-an-account-per-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-116239 · Severity: high · CVSS 8.5 · Published 2026-10-30

pgAdmin 4 in server mode can confuse user accounts from different authentication sources (LDAP, Kerberos, internal) when they share the same username. An attacker with valid LDAP or Kerberos credentials can log in as a different user, including administrators, gaining access to that account's database servers and stored credentials. This vulnerability affects database administrators and organizations using pgAdmin with multiple authentication methods.

Technologies: [pgAdmin Project pgAdmin 4](https://junglewise.ai/threats/technologies/pgadmin-project-pgadmin-4). Vendors: [pgAdmin Project](https://junglewise.ai/threats/vendors/pgadmin-project).

## Quick answers

**Is CVE-2026-116239 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116239 being exploited in the wild.

**How severe is CVE-2026-116239?** High severity, with a CVSS score of 8.5, published 30 October 2026.

**Which products and versions are affected?** pgAdmin Project pgAdmin 4 before 9.19.

**Is there a fix for CVE-2026-116239?** Yes: fixed in pgAdmin 4 9.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116239 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116239?** Check whether you run pgAdmin Project pgAdmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in pgAdmin 4 9.19

## Technical details

The vulnerability is an authentication source confusion bug in pgAdmin 4 server mode. When a user authenticates via LDAP or Kerberos, pgAdmin looks up the account by username alone rather than verifying the authentication source matches the account's source, allowing a user from one source to be logged in as an account from another source. An attacker with valid LDAP or Kerberos credentials can impersonate internal accounts, including the initial administrator account, by providing the matching username or email.

## Affected products

- pgAdmin Project pgAdmin 4 before 9.19

## Timeline

- 2026-10-30: disclosed

## Related threats

- [pgAdmin 4 connection string injection via materialized view refresh](https://junglewise.ai/threats/cve-2026-116252-pgadmin-4-s-materialized-view-refresh-passed-the-target-database)
- [pgAdmin 4 path traversal via symlink in file operations](https://junglewise.ai/threats/cve-2026-116250-in-server-mode-pgadmin-4-validates-a-path-a-user-gives-for-a)
- [pgAdmin 4 credential fallback to OS defaults](https://junglewise.ai/threats/cve-2026-116247-when-a-server-in-pgadmin-4-had-no-password-file-client)
- [pgAdmin 4 password disclosure via environment variable inheritance](https://junglewise.ai/threats/cve-2026-116246-to-pass-a-server-s-password-to-psql-and-to-the-utilities-pgadmin)