CVE-2026-116238
Description
A flaw was found in pgAdmin 4 when operating in server mode. The application fails to properly enforce failed login limits on internal accounts due to exposed framework authentication endpoints, case-sensitivity discrepancies during username matching, and improper handling of multiple authentication sources. An unauthenticated remote attacker can exploit these weaknesses to bypass account lockout controls and conduct unlimited brute-force password guessing attacks. Successful exploitation can lead to account takeover, granting unauthorized access to internal user and administrator accounts.
Statement
Red Hat rates the severity of this vulnerability as Important because unauthenticated remote attackers can circumvent failed login thresholds to conduct unrestricted password brute-forcing against administrative users, potentially resulting in full compromise of the database management console. The issue specifically threatens environments running pgAdmin 4 in multi-user server mode, whereas local standalone desktop installations remain unaffected. Although an exploit requires successfully guessing valid credentials, exposing authentication endpoints over public or untrusted networks significantly increases the risk of account takeover.
Mitigation
Restrict access to the pgAdmin 4 web service to trusted management networks or localhost:
1. Remove general public access to the port running pgAdmin (for example, port 5050 or HTTP/HTTPS ports):
firewall-cmd --permanent --remove-port=5050/tcp
2. Restrict incoming connections to trusted administrator subnets:
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="5050" protocol="tcp" accept'
3. Reload the firewall to apply rules:
firewall-cmd --reload
Warning: Reloading firewall rules will alter active network filtering policies and may disrupt existing connections or block administrative access if the source subnet is incorrectly specified.
Alternatively, if central multi-user access is not required, run pgAdmin 4 exclusively in desktop mode. Where an external reverse proxy (such as Apache HTTP Server or NGINX) is deployed in front of pgAdmin, enforce rate-limiting rules and IP filtering on authentication endpoints to mitigate automated brute-force attempts.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
