https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 09:32:07 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-116242 <p>pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that account&#39;s ~/.ssh/config (IdentityFile, User, HostName, ProxyCommand) for the tunnel host, and could use its ssh-agent. In server mode any user could therefore configure a tunnel to a host that accepts the service account&#39;s key, with no credentials of their own or with an identity file that did not exist in their storage, and reach it as that account.</p> <p>The fix makes tunnels in server mode use only the identity file or password the user configured: the service account&#39;s keys, configuration and agent are no longer used, and an identity file that cannot be found in the user&#39;s storage is reported instead of falling back to ~/.ssh. Desktop mode is unchanged.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> <p>pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that account&#39;s ~/.ssh/config (IdentityFile, User, HostName, ProxyCommand) for the tunnel host, and could use its ssh-agent. In server mode any user could therefore configure a tunnel to a host that accepts the service account&#39;s key, with no credentials of their own or with an identity file that did not exist in their storage, and reach it as that account.</p> <p>The fix makes tunnels in server mode use only the identity file or password the user configured: the service account&#39;s keys, configuration and agent are no longer used, and an identity file that cannot be found in the user&#39;s storage is reported instead of falling back to ~/.ssh. Desktop mode is unchanged.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> https://db.gcve.eu/vuln/fkie_cve-2026-116242 https://db.gcve.eu/vuln/ghsa-949g-5qqm-q7xc <p>pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that account&#39;s ~/.ssh/config (IdentityFile, User, HostName, ProxyCommand) for the tunnel host, and could use its ssh-agent. In server mode any user could therefore configure a tunnel to a host that accepts the service account&#39;s key, with no credentials of their own or with an identity file that did not exist in their storage, and reach it as that account.</p> <p>The fix makes tunnels in server mode use only the identity file or password the user configured: the service account&#39;s keys, configuration and agent are no longer used, and an identity file that cannot be found in the user&#39;s storage is reported instead of falling back to ~/.ssh. Desktop mode is unchanged.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> <p>pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that account&#39;s ~/.ssh/config (IdentityFile, User, HostName, ProxyCommand) for the tunnel host, and could use its ssh-agent. In server mode any user could therefore configure a tunnel to a host that accepts the service account&#39;s key, with no credentials of their own or with an identity file that did not exist in their storage, and reach it as that account.</p> <p>The fix makes tunnels in server mode use only the identity file or password the user configured: the service account&#39;s keys, configuration and agent are no longer used, and an identity file that cannot be found in the user&#39;s storage is reported instead of falling back to ~/.ssh. Desktop mode is unchanged.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> https://db.gcve.eu/vuln/ghsa-949g-5qqm-q7xc