Is CVE-2026-116245 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116245 being exploited in the wild.

How severe is CVE-2026-116245?

High severity, with a CVSS score of 8.2, published 30 October 2026.

How is CVE-2026-116245 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116245?

Check whether you run Pgadmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116245: pgAdmin credential injection via libpq service file

CVE-2026-116245 · Severity: high · CVSS 8.2 · Published 2026-10-30

pgAdmin 4 is a web-based management tool for PostgreSQL databases. When running in server mode, an attacker with web access could manipulate database connection settings to reference libpq service entries configured on the operating system, potentially obtaining database credentials or certificates stored by the system administrator. This could allow unauthorized database access or credential theft.

Technologies: Pgadmin 4. Vendors: pgAdmin.

Quick answers

Is CVE-2026-116245 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116245 being exploited in the wild.
How severe is CVE-2026-116245?: High severity, with a CVSS score of 8.2, published 30 October 2026.
Which products and versions are affected?: Pgadmin 4 before 9.19.
Is there a fix for CVE-2026-116245?: Yes: fixed in pgAdmin 4 9.19. Until then: Configure the SERVER_MODE_ALLOWED_SERVICES setting with an allowlist of permitted services; by default this setting is empty, preventing all service-based connections until explicitly configured. Remove PGPASSWORD and PGSERVICE environment variables from the OS account running pgAdmin. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116245 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116245?: Check whether you run Pgadmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: pgAdmin 4 9.19

Configure the SERVER_MODE_ALLOWED_SERVICES setting with an allowlist of permitted services; by default this setting is empty, preventing all service-based connections until explicitly configured. Remove PGPASSWORD and PGSERVICE environment variables from the OS account running pgAdmin.

Technical details

libpq (PostgreSQL's client library) automatically loads connection credentials from the operating system's service file, PGPASSWORD and PGSERVICE environment variables without validating their origin. In pgAdmin 4 server mode, any authenticated user could set a server's Service parameter or connection string to reference these privileged entries, causing pgAdmin to authenticate using the OS account's stored credentials. The vulnerability additionally affects pg_dumpall database name handling and servicefile parameters.

Affected products

pgAdmin pgAdmin 4 before 9.19

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.