# CVE-2026-116248: pgAdmin 4 unauthorized server sharing to all users

Source: https://junglewise.ai/threats/cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-116248 · Severity: medium · CVSS 6.8 · Published 2026-10-30

pgAdmin 4 is a management interface for PostgreSQL databases. A flaw in access controls allowed non-administrator users to share database server connections with all other users on the system, despite this being restricted to administrators. An attacker could plant a malicious server in other users' server lists to harvest their database credentials when they connect.

Technologies: [Pgadmin 4](https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4). Vendors: [pgAdmin](https://junglewise.ai/threats/vendors/pgadmin).

## Quick answers

**Is CVE-2026-116248 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116248 being exploited in the wild.

**How severe is CVE-2026-116248?** Medium severity, with a CVSS score of 6.8, published 30 October 2026.

**Which products and versions are affected?** Pgadmin 4 before 9.19.

**Is there a fix for CVE-2026-116248?** Yes: fixed in pgAdmin 4 9.19 and later. Until then: Restrict user registration to trusted administrators only, or disable the server sharing feature until upgraded to a patched version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116248 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116248?** Check whether you run Pgadmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in pgAdmin 4 9.19 and later

Restrict user registration to trusted administrators only, or disable the server sharing feature until upgraded to a patched version.

## Technical details

The vulnerability exists in pgAdmin 4's server API create and update endpoints, which failed to validate whether the requesting user was an administrator before processing a "shared" flag that makes a server visible to all users. Additionally, the servers.json import removed non-administrator shared entries only after validation, allowing a file with an invalid entry to bypass this check. An attacker with user registration capability could share a server with all users, directing them to an attacker-controlled host to intercept database credentials.

## Affected products

- pgAdmin pgAdmin 4 before 9.19

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/server_groups/servers/__init__.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/server_groups/servers/__init__.py)
- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/__init__.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/__init__.py)

## Related threats

- [pgAdmin 4 session invalidation failure after password change](https://junglewise.ai/threats/cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when)
- [pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl)
- [pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the)
- [pgAdmin 4 Kerberos credential exposure authentication bypass](https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user)
- [pgAdmin 4 arbitrary code execution via binary path validation bypass](https://junglewise.ai/threats/cve-2026-116243-pgadmin-4-runs-pg-dump-pg-restore-pg-dumpall-and-psql-from-the)