Vulnerability-Lookup

GHSA-835V-3MJ2-2W29

Vulnerability from github – Published: 2026-10-30 21:32 – Updated: 2026-10-30 21:32

Details

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environment is shared by every user's requests and copied into every process it starts, so in server mode another user's later PSQL session or utility inherited the password, and libpq used PGPASSWORD for any connection made without a password of its own, letting one user connect with another user's saved password.

The fix puts the password only into the environment built for the process that needs it and starts psql with a copy of pgAdmin's environment instead of the environment itself.

This issue affects pgAdmin 4: before 9.19.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

7.0 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-116246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-214"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-30T20:17:04Z",
    "severity": "HIGH"
  },
  "details": "To pass a server\u0027s password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin\u0027s own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin\u0027s environment is shared by every user\u0027s requests and copied into every process it starts, so in server mode another user\u0027s later PSQL session or utility inherited the password, and libpq used PGPASSWORD for any connection made without a password of its own, letting one user connect with another user\u0027s saved password.\n\nThe fix puts the password only into the environment built for the process that needs it and starts psql with a copy of pgAdmin\u0027s environment instead of the environment itself.\n\nThis issue affects pgAdmin 4: before 9.19.",
  "id": "GHSA-835v-3mj2-2w29",
  "modified": "2026-10-30T21:32:21Z",
  "published": "2026-10-30T21:32:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116246"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgadmin-org/pgadmin4/issues/10653"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgadmin-org/pgadmin4/commit/0eefa38f774dce07c1f939d87f2993b36e2313b9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-116246 (GCVE-0-2026-116246)

Vulnerability from cvelistv5 – Published: 2026-10-30 19:55 – Updated: 2026-10-30 19:55

Title

pgAdmin 4: Server passwords are left in pgAdmin's process environment

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

7 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N

CWE

CWE-214 - Invocation of Process Using Visible Sensitive Information
CWE-526 - Cleartext Storage of Sensitive Information in an Environment Variable

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 69/100 over 115 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/pgadmin-org/pgadmin4/issues/10653	issue-tracking
https://github.com/pgadmin-org/pgadmin4/commit/0e…	patch

Impacted products

1 product

Vendor	Product	Version
pgadmin.org	pgAdmin 4	Affected: 0 , < 9.19 (custom)

Date Public

2026-10-29 00:00

Credits

Dave Page <dpage@pgadmin.org> Kundan Sable <kundan.sable@enterprisedb.com> Ashesh Vashi <ashesh.vashi@enterprisedb.com>

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "PSQL Tool",
            "Backup",
            "Restore",
            "Import/Export Data",
            "Maintenance"
          ],
          "product": "pgAdmin 4",
          "programFiles": [
            "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py",
            "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/bgprocess/processes.py",
            "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/psql/__init__.py"
          ],
          "repo": "https://github.com/pgadmin-org/pgadmin4",
          "vendor": "pgadmin.org",
          "versions": [
            {
              "lessThan": "9.19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dave Page \u003cdpage@pgadmin.org\u003e"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Kundan Sable \u003ckundan.sable@enterprisedb.com\u003e"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Ashesh Vashi \u003cashesh.vashi@enterprisedb.com\u003e"
        }
      ],
      "datePublic": "2026-10-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "To pass a server\u0027s password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin\u0027s own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin\u0027s environment is shared by every user\u0027s requests and copied into every process it starts, so in server mode another user\u0027s later PSQL session or utility inherited the password, and libpq used PGPASSWORD for any connection made without a password of its own, letting one user connect with another user\u0027s saved password.\n\nThe fix puts the password only into the environment built for the process that needs it and starts psql with a copy of pgAdmin\u0027s environment instead of the environment itself.\n\nThis issue affects pgAdmin 4: before 9.19."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Requires the PSQL tool to be enabled (ENABLE_PSQL) and another user to have used it (User Interaction Required), and the attacker\u0027s connection or utility to follow in the same pgAdmin process (Attack Complexity High). The gain is real only for users without the PSQL tool permission: a user who has it already holds a shell as the pgAdmin account. Scope is Changed because the password belongs to another user; Confidentiality is High for it. Integrity is Low, reflecting that the attacker\u0027s use of the other user\u0027s database identity is constrained by these conditions; Availability is None."
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Same reasoning as the CVSS 3.1 entry. AT:P for the timing and configuration conditions, UI:P because the victim only has to use the PSQL tool. VC:H for the leaked password; SC:H/SI:L for the database server it opens."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-214",
              "description": "CWE-214 Invocation of Process Using Visible Sensitive Information",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-526",
              "description": "CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T19:55:16.276Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/pgadmin-org/pgadmin4/issues/10653"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/pgadmin-org/pgadmin4/commit/0eefa38f774dce07c1f939d87f2993b36e2313b9"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "pgAdmin 4: Server passwords are left in pgAdmin\u0027s process environment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-116246",
    "datePublished": "2026-10-30T19:55:16.276Z",
    "dateReserved": "2026-10-25T16:26:16.419Z",
    "dateUpdated": "2026-10-30T19:55:16.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted