CVE-2026-116245

Remove ambient PostgreSQL credentials and connection files from the host environment executing the pgAdmin 4 service:

1. Remove any `PGPASSWORD` or `PGSERVICE` environment variables configured for the service user or defined in systemd unit overrides.
2. Restrict or remove PostgreSQL connection service files (`/etc/pg_service.conf` or `~/.pg_service.conf` under the service user's home directory) to prevent the underlying libpq library from accessing stored credentials:

sh
chmod 600 ~/.pg_service.conf

Alternatively, remove credentials stored within connection service files so that connections require explicit user authentication.

3. Restart the service to ensure sanitized environment variables take effect:

sh
systemctl restart pgadmin4

Warning: Restarting the pgAdmin service terminates active client sessions and temporarily interrupts service availability. Removing connection service definitions may require users or background jobs to input authentication parameters manually.

--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce strict allowlisting of database connection services and eliminate ambient credential inheritance by libpq in pgAdmin 4 server mode: upgrade to pgAdmin 4 9.19, which restrict allowed services to the SERVER_MODE_ALLOWED_SERVICES allowlist, reject the servicefile parameter, strip PGPASSWORD and PGSERVICE from the environment at startup, and wrap maintenance database names for pg_dumpall, closing all 5 injection vectors (specifying a service name in server connection settings, passing a service connection parameter, passing a servicefile connection parameter, injecting connection parameters via crafted maintenance database names in pg_dumpall, omitting credentials to inherit ambient PGPASSWORD and PGSERVICE environment variables). Until patched, this is only a concern on pgAdmin 4 running in multi-user server mode — Deployments operating exclusively in standalone desktop mode are unaffected — so Remove PGPASSWORD and PGSERVICE environment variables from the host service user and systemd overrides, restrict permissions or remove connection service files (/etc/pg_service.conf and ~/.pg_service.conf), and restart the pgadmin4 service. As a compensating measure, Sanitize input delimiters to prevent injection of connection string directives through crafted maintenance database names passed to downstream utilities like pg_dumpall. These controls limit blast radius and contain exploitation, but they do not fix the underlying service credential reuse defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)