https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 21:46:24 +0000 https://db.gcve.eu/vuln/cve-2026-116245 <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server&#39;s Service, or a &#34;service&#34; connection parameter, to one of those entries and connect with its credentials. A PGPASSWORD or PGSERVICE variable set for that account was likewise used by libpq for every connection without a value of its own and passed on to the utilities, and pg_dumpall read a maintenance database name such as &#34;service=...&#34; as a connection string.</p> <p>The fix adds the SERVER_MODE_ALLOWED_SERVICES setting, empty by default: in server mode only a listed service can be used, the servicefile parameter is refused, and PGPASSWORD and PGSERVICE are removed from pgAdmin&#39;s environment at startup. The allowlist is checked again on the final connection string, and the pg_dumpall database name is wrapped as a connection string.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server&#39;s Service, or a &#34;service&#34; connection parameter, to one of those entries and connect with its credentials. A PGPASSWORD or PGSERVICE variable set for that account was likewise used by libpq for every connection without a value of its own and passed on to the utilities, and pg_dumpall read a maintenance database name such as &#34;service=...&#34; as a connection string.</p> <p>The fix adds the SERVER_MODE_ALLOWED_SERVICES setting, empty by default: in server mode only a listed service can be used, the servicefile parameter is refused, and PGPASSWORD and PGSERVICE are removed from pgAdmin&#39;s environment at startup. The allowlist is checked again on the final connection string, and the pg_dumpall database name is wrapped as a connection string.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> https://db.gcve.eu/vuln/cve-2026-116245