# CVE-2026-116242: pgAdmin 4 SSH tunnel privilege escalation via service account keys

Source: https://junglewise.ai/threats/cve-2026-116242-pgadmin-4-opens-ssh-tunnels-with-the-sshtunnel-library-but-gave  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-116242 · Severity: high · CVSS 8.2 · Published 2026-10-30

pgAdmin 4 is a web-based database administration tool that allows users to configure SSH tunnels to reach database servers. In server mode, the application incorrectly used the SSH private keys and configuration of the service account running pgAdmin itself, rather than restricting access to user-supplied credentials. An attacker with access to pgAdmin could configure an SSH tunnel using the service account's unencrypted private keys to reach hosts that trust that account, gaining unauthorized access to systems and data.

Technologies: [Pgadmin 4](https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4). Vendors: [pgAdmin](https://junglewise.ai/threats/vendors/pgadmin).

## Quick answers

**Is CVE-2026-116242 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116242 being exploited in the wild.

**How severe is CVE-2026-116242?** High severity, with a CVSS score of 8.2, published 30 October 2026.

**Which products and versions are affected?** Pgadmin 4 before 9.19.

**Is there a fix for CVE-2026-116242?** Yes: fixed in pgAdmin 4 9.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116242 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116242?** Check whether you run Pgadmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in pgAdmin 4 9.19

## Technical details

The sshtunnel library was initialized without host_pkey_directories or ssh_config_file parameters, causing it to fall back to the operating system account's ~/.ssh directory for unencrypted private keys and ~/.ssh/config settings. In server mode, any user could configure a tunnel to a host accepting the service account's key without supplying their own credentials or identity file. The fix restricts server-mode tunnels to only user-configured identity files or passwords, removing access to the service account's keys, configuration, and ssh-agent.

## Affected products

- pgAdmin pgAdmin 4 before 9.19

## Timeline

- 2026-10-30: disclosed
- 2026-10-24: patched

## References

- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py)
- [https://github.com/pgadmin-org/pgadmin4/commit/d52fe4740eb1af89d940f2e412bd66a0a89f08bb](https://github.com/pgadmin-org/pgadmin4/commit/d52fe4740eb1af89d940f2e412bd66a0a89f08bb)

## Related threats

- [pgAdmin 4 session invalidation failure after password change](https://junglewise.ai/threats/cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when)
- [pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl)
- [pgAdmin 4 unauthorized server sharing to all users](https://junglewise.ai/threats/cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share)
- [pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the)
- [pgAdmin 4 Kerberos credential exposure authentication bypass](https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user)