CVE-2026-116244
Description
A flaw was found in pgAdmin. When establishing database connections that do not use delegated credentials, the application improperly falls back to the default credentials of the underlying operating system service account. In server mode, an authenticated user can exploit this behavior to connect to databases under the service account's identity, regardless of the username provided. This flaw allows privilege escalation and unauthorized database access with the privileges of the service account.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to isolate Kerberos environment variables and disallow GSSAPI and SSPI authentication fallback to the host service account on non-delegated database connections: upgrade to pgAdmin 4 9.19, which points KRB5CCNAME and KRB5_CLIENT_KTNAME to a non-existent file for non-Kerberos sessions and appends require_auth=!gss,!sspi and gssencmode=disable to connection parameters and utility environments, closing all 4 injection vectors (GSSAPI authentication fallback to the service account Kerberos ticket cache, GSSAPI authentication fallback to the service account client keytab, SSPI authentication fallback to the Windows service account logon, Environment inheritance of credential caches in spawned psql processes). Until patched, this is only a concern on pgAdmin 4 server mode deployments where the host service account holds an active Kerberos ticket cache, client keytab, or SSPI logon — Standalone desktop installations or environments where the daemon does not maintain ambient Kerberos credentials are unaffected — so Ensure the host operating system service account running pgAdmin does not hold active Kerberos ticket caches, client keytabs, or SSPI logon sessions, and restrict database server registration privileges. These controls limit blast radius and contain exploitation, but they do not fix the underlying service account credential fallback defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
