CVE-2026-116239

Limit network access to the pgAdmin web service so only trusted administrative hosts can connect, or configure the application to rely on a single authentication source rather than mixed authentication providers.

1. Restrict incoming traffic to pgAdmin using firewalld to allow connections only from designated management networks:

firewall-cmd --permanent --zone=internal --add-source=<MANAGEMENT_SUBNET>
firewall-cmd --permanent --zone=internal --add-service=http
firewall-cmd --reload

2. If multi-source authentication is not required, define a single identity provider in the pgAdmin configuration (such as `AUTHENTICATION_SOURCES = ['internal']` or `AUTHENTICATION_SOURCES = ['ldap']`) to eliminate cross-source account matching. In environments where multiple providers are necessary, ensure internal administrative usernames do not match any existing identities within external Kerberos or LDAP directories.

Caveats:
Restricting access by network policy will prevent users connecting outside authorized administrative networks from reaching pgAdmin. Restricting authentication sources prevents users from authenticating via disabled directory mechanisms.

Warning: Applying firewall rules with `firewall-cmd --reload` or restarting the web server hosting pgAdmin will briefly interrupt active client sessions.

--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to bind pgAdmin user sessions to accounts by verifying both username and authenticating provider rather than resolving accounts by username alone or unvalidated form input: upgrade to pgAdmin 4 9.19, which query user accounts using both the authenticated username and authenticating source, ignore form.user for external authentication sources, and restrict internal logins to internal accounts, closing all 3 injection vectors (LDAP authentication with colliding username, Kerberos authentication with colliding username, Login form email input matching target account when internal authentication is prioritized). Until patched, this is only a concern on pgAdmin 4 multi-user server mode deployments with multiple authentication sources enabled — pgAdmin 4 standalone desktop mode installations are unaffected — so Configure pgAdmin to rely on a single authentication provider in AUTHENTICATION_SOURCES, ensure internal administrative usernames do not match external directory identities, and restrict incoming network traffic to trusted management networks. As a compensating measure, Log administrative operations performed within pgAdmin to a SIEM to detect unauthorized actions taken via hijacked administrative accounts. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper authentication source validation defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1008 Application Admin Event Logging (SIEM Integration) (medium)