# CVE-2026-116252: pgAdmin 4 connection string injection via materialized view refresh

Source: https://junglewise.ai/threats/cve-2026-116252-pgadmin-4-s-materialized-view-refresh-passed-the-target-database  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-116252 · Severity: medium · CVSS 6.5 · Published 2026-10-30

pgAdmin 4 is a web-based administration tool for PostgreSQL databases. When refreshing a materialized view, pgAdmin passes the database name directly to the psql command without sanitization. An attacker with CREATEDB privileges can create a database with a specially crafted name containing connection parameters, which libpq interprets as a full connection string, causing pgAdmin to connect to an attacker-controlled server and leak the user's saved password.

Technologies: [pgAdmin Project pgAdmin 4](https://junglewise.ai/threats/technologies/pgadmin-project-pgadmin-4). Vendors: [pgAdmin Project](https://junglewise.ai/threats/vendors/pgadmin-project).

## Quick answers

**Is CVE-2026-116252 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116252 being exploited in the wild.

**How severe is CVE-2026-116252?** Medium severity, with a CVSS score of 6.5, published 30 October 2026.

**Which products and versions are affected?** pgAdmin Project pgAdmin 4 before 9.19.

**Is there a fix for CVE-2026-116252?** Yes: fixed in pgAdmin 4 9.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116252 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116252?** Check whether you run pgAdmin Project pgAdmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in pgAdmin 4 9.19

## Technical details

The vulnerability is a command injection flaw in the materialized view refresh function (MViewNode.refresh_data). The database name is passed unsanitized to psql's --dbname argument; libpq treats values containing "=" or postgresql:// URIs as full connection strings, allowing an attacker to override host, port, and other connection parameters. An attacker with CREATEDB privileges can craft a database name like 'host=attacker port=5432 dbname=postgres' to redirect connections and capture credentials. The fix routes the database name through the database_conninfo() helper function, which properly escapes it so libpq treats it only as a database name.

## Affected products

- pgAdmin Project pgAdmin 4 before 9.19

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/server_groups/servers/databases/schemas/views/__init__.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/server_groups/servers/databases/schemas/views/__init__.py)
- [https://github.com/pgadmin-org/pgadmin4/commit/a1a43e8c28cf10cec73df0c476905562d19af483](https://github.com/pgadmin-org/pgadmin4/commit/a1a43e8c28cf10cec73df0c476905562d19af483)

## Related threats

- [pgAdmin 4 path traversal via symlink in file operations](https://junglewise.ai/threats/cve-2026-116250-in-server-mode-pgadmin-4-validates-a-path-a-user-gives-for-a)
- [pgAdmin 4 credential fallback to OS defaults](https://junglewise.ai/threats/cve-2026-116247-when-a-server-in-pgadmin-4-had-no-password-file-client)
- [pgAdmin 4 password disclosure via environment variable inheritance](https://junglewise.ai/threats/cve-2026-116246-to-pass-a-server-s-password-to-psql-and-to-the-utilities-pgadmin)
- [pgAdmin 4 authentication source confusion leading to account takeover](https://junglewise.ai/threats/cve-2026-116239-in-server-mode-pgadmin-4-keeps-an-account-per-authentication)