# CVE-2026-116247: pgAdmin 4 credential fallback to OS defaults

Source: https://junglewise.ai/threats/cve-2026-116247-when-a-server-in-pgadmin-4-had-no-password-file-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-116247 · Severity: high · CVSS 8.2 · Published 2026-10-30

pgAdmin 4 is a web-based administration tool for PostgreSQL databases. When configured without explicit passwords or client certificates, it falls back to the service account's default credentials stored on the operating system, allowing any authenticated user of pgAdmin to impersonate the service account and access databases without proper authorization. Attackers could gain unauthorized database access using the server's saved credentials or client certificates.

Technologies: [pgAdmin Project pgAdmin 4](https://junglewise.ai/threats/technologies/pgadmin-project-pgadmin-4). Vendors: [pgAdmin Project](https://junglewise.ai/threats/vendors/pgadmin-project).

## Quick answers

**Is CVE-2026-116247 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116247 being exploited in the wild.

**How severe is CVE-2026-116247?** High severity, with a CVSS score of 8.2, published 30 October 2026.

**Which products and versions are affected?** pgAdmin Project pgAdmin 4 before 9.19.

**Is there a fix for CVE-2026-116247?** Yes: fixed in pgAdmin 4 9.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116247 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116247?** Check whether you run pgAdmin Project pgAdmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in pgAdmin 4 9.19

## Technical details

When pgAdmin 4 server mode lacks configured password files, client certificates, or client keys, the libpq connection library falls back to OS-level defaults (~/.pgpass, ~/.postgresql/postgresql.crt, PGPASSFILE, PGSSLCERT, PGSSLKEY). Any pgAdmin user can exploit this to connect as the service account; supplying a public certificate is sufficient for libpq to pair it with the service account's private key. The vulnerability affects server mode; desktop mode is unaffected.

## Affected products

- pgAdmin Project pgAdmin 4 before 9.19

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py)
- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/__init__.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/__init__.py)

## Related threats

- [pgAdmin 4 connection string injection via materialized view refresh](https://junglewise.ai/threats/cve-2026-116252-pgadmin-4-s-materialized-view-refresh-passed-the-target-database)
- [pgAdmin 4 path traversal via symlink in file operations](https://junglewise.ai/threats/cve-2026-116250-in-server-mode-pgadmin-4-validates-a-path-a-user-gives-for-a)
- [pgAdmin 4 password disclosure via environment variable inheritance](https://junglewise.ai/threats/cve-2026-116246-to-pass-a-server-s-password-to-psql-and-to-the-utilities-pgadmin)
- [pgAdmin 4 authentication source confusion leading to account takeover](https://junglewise.ai/threats/cve-2026-116239-in-server-mode-pgadmin-4-keeps-an-account-per-authentication)