Is CVE-2026-116249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116249 being exploited in the wild.

How severe is CVE-2026-116249?

High severity, with a CVSS score of 8.4, published 30 October 2026.

Is there a fix for CVE-2026-116249?

Yes: fixed in pgAdmin 4 9.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116249 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116249?

Check whether you run Pgadmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116249: pgAdmin 4 path traversal in server credentials

CVE-2026-116249 · Severity: high · CVSS 8.4 · Published 2026-10-30

pgAdmin 4, a web-based management tool for PostgreSQL databases, allows authenticated users to configure server connections with sensitive files like passwords and SSH keys. A vulnerability in how pgAdmin resolves file paths enables attackers to access other users' credential files, SSH keys, and certificates by using directory traversal attacks. Exploiting this could lead to database access compromise, credential theft, and unauthorized SSH connections.

Technologies: Pgadmin 4. Vendors: pgAdmin.

Quick answers

Is CVE-2026-116249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116249 being exploited in the wild.
How severe is CVE-2026-116249?: High severity, with a CVSS score of 8.4, published 30 October 2026.
Which products and versions are affected?: Pgadmin 4 before 9.19.
Is there a fix for CVE-2026-116249?: Yes: fixed in pgAdmin 4 9.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116249 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116249?: Check whether you run Pgadmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: pgAdmin 4 9.19

Technical details

In server mode, pgAdmin 4's get_complete_file_path() function insufficiently validates file paths for password files, SSL certificates, keys, CRLs, and SSH tunnel identity files, only stripping leading slashes before path joining. Attackers can bypass this via paths like "../<another_user>/.pgpass" submitted through the server dialog, REST API, or servers.json import. Additionally, the sslkeylogfile parameter is passed to libpq unvalidated, allowing file creation outside the storage directory, and make_conninfo() fails to validate libpq connection parameter names, enabling keyword smuggling attacks.

Affected products

pgAdmin pgAdmin 4 before 9.19

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.