Is CVE-2026-116246 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116246 being exploited in the wild.

How severe is CVE-2026-116246?

Medium severity, with a CVSS score of 6.5, published 30 October 2026.

Which products and versions are affected?

pgAdmin Project pgAdmin 4 before 9.19.

Is there a fix for CVE-2026-116246?

Yes: fixed in pgAdmin 4 9.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116246 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-116246?

Check whether you run pgAdmin Project pgAdmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116246: pgAdmin 4 password disclosure via environment variable inheritance

CVE-2026-116246 · Severity: medium · CVSS 6.5 · Published 2026-10-30

pgAdmin 4 is a web-based database management tool for PostgreSQL. In server mode where multiple users access the same instance, the application stored database passwords in its process environment where they persisted across requests. This allowed one user to connect to another user's database server using the stolen credentials, potentially gaining unauthorized access to sensitive data.

Technologies: pgAdmin Project pgAdmin 4. Vendors: pgAdmin Project.

Quick answers

Is CVE-2026-116246 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116246 being exploited in the wild.
How severe is CVE-2026-116246?: Medium severity, with a CVSS score of 6.5, published 30 October 2026.
Which products and versions are affected?: pgAdmin Project pgAdmin 4 before 9.19.
Is there a fix for CVE-2026-116246?: Yes: fixed in pgAdmin 4 9.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116246 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-116246?: Check whether you run pgAdmin Project pgAdmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: pgAdmin 4 9.19

Technical details

The vulnerability stems from pgAdmin 4 setting PGPASSWORD and other per-process password variables in its shared process environment without clearing them afterward. In server mode, subsequent user requests and spawned child processes (psql, utilities) inherited this environment, allowing attackers to extract credentials via environment inspection or by having libpq automatically use the PGPASSWORD variable for connections. The fix isolates passwords to process-specific environments passed only to the processes that require them.

Affected products

pgAdmin Project pgAdmin 4 before 9.19

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.