https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 22:52:05 +0000 https://db.gcve.eu/vuln/cve-2026-116252 <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>pgAdmin 4&#39;s materialized view refresh passed the target database&#39;s name to psql&#39;s --dbname argument unchanged. libpq treats a --dbname value containing &#34;=&#34; (or a postgresql:// URI) as a full connection string, whose keywords override the host, port and other settings pgAdmin had supplied. A database whose name is such a string, which any role with CREATEDB can create, therefore redirected the psql process pgAdmin starts for the refresh to a host and port of the creator&#39;s choosing, and the connecting user&#39;s saved server password was presented to that endpoint. It also let the pgAdmin host be made to open connections to arbitrary addresses.</p> <p>The same weakness was fixed for Backup, Restore, Maintenance and Import/Export Data in earlier releases (CVE-2026-86862); the materialized view refresh was the remaining caller. The fix routes the name through the same database_conninfo() helper, so libpq treats it strictly as a database name.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>pgAdmin 4&#39;s materialized view refresh passed the target database&#39;s name to psql&#39;s --dbname argument unchanged. libpq treats a --dbname value containing &#34;=&#34; (or a postgresql:// URI) as a full connection string, whose keywords override the host, port and other settings pgAdmin had supplied. A database whose name is such a string, which any role with CREATEDB can create, therefore redirected the psql process pgAdmin starts for the refresh to a host and port of the creator&#39;s choosing, and the connecting user&#39;s saved server password was presented to that endpoint. It also let the pgAdmin host be made to open connections to arbitrary addresses.</p> <p>The same weakness was fixed for Backup, Restore, Maintenance and Import/Export Data in earlier releases (CVE-2026-86862); the materialized view refresh was the remaining caller. The fix routes the name through the same database_conninfo() helper, so libpq treats it strictly as a database name.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> https://db.gcve.eu/vuln/cve-2026-116252