CVE-2026-116242
Description
A flaw was found in pgadmin4. When running in server mode, the application improperly falls back to using the host operating system service account's Secure Shell (SSH) configuration, private keys, and authentication agent when establishing SSH tunnels. An authenticated user can exploit this vulnerability by configuring an SSH tunnel without providing valid personal credentials. Successful exploitation allows the user to establish unauthorized connections to remote systems by impersonating the pgAdmin service account.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
Remove unencrypted SSH keys and client configuration files from the home directory of the operating system account running the pgAdmin service, and ensure no active ssh-agent is shared with the process:
1. Relocate the service account's SSH directory:
mv ~/.ssh ~/.ssh.backup
2. Unset the `SSH_AUTH_SOCK` environment variable and ensure no `ssh-agent` process is accessible to the service account.
3. Restart the service to terminate any inherited agent connections:
systemctl restart pgadmin4.service
Warning: Restarting the pgAdmin service will temporarily disconnect active sessions and reload runtime configurations.
Caveats: Disabling or moving these credentials will cause failures for any legitimate server-side scripts or background tasks that rely on automated SSH key authentication under this service account.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to prevent pgAdmin 4 server mode SSH tunnels from falling back to the host service account private keys, SSH configuration, and active ssh-agent: upgrade to pgAdmin 4 9.19, which pass empty host key directories, use os.devnull as the SSH configuration file, disable ssh-agent in server mode, and return an explicit error if a configured identity file cannot be found in user storage, closing all 2 injection vectors (SSH tunnel configuration with empty personal credentials, SSH tunnel configuration referencing a nonexistent identity file). Until patched, this is only a concern on pgAdmin 4 multi-user server mode deployments — pgAdmin 4 desktop mode installations are unaffected — so remove unencrypted SSH keys and client configuration from the pgAdmin service account home directory, unset SSH_AUTH_SOCK, and restart the service to eliminate access to any running ssh-agent. As a compensating measure, restrict SSH identity file resolution strictly to the authenticated user's isolated storage directory, preventing fallback to the host service account's ~/.ssh directory and restrict outbound SSH tunnel connections to an approved allowlist of destination hosts and ports, bounding unauthorized lateral access. These controls limit blast radius and contain exploitation, but they do not fix the underlying ambient credential reuse defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1303 Application-Level Filesystem Access Confinement (medium)
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
The impact of insecure defaults varies widely depending on the functionality that the product controls.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
