CVE-2026-116246

Description

A flaw was found in pgAdmin 4. This vulnerability allows an authenticated user to obtain sensitive credentials and achieve unauthorized database access when the application runs in server mode. When executing background utilities or command-line database sessions, pgAdmin 4 writes database passwords into its shared process environment without removing them afterwards. A subsequent user can inherit these residual credentials, enabling them to connect to database servers using another user's saved credentials.

Statement

Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Mitigation

Avoid saving database passwords in pgAdmin connection profiles, or run the application in desktop mode.

1. Avoid storing credentials: When registering PostgreSQL servers in pgAdmin, leave the password field empty and do not select the "Save Password" option. This prevents credentials from being written into the process environment.

2. Enforce Desktop Mode: For single-user environments, disable server mode by adding or modifying the following parameter in `config_local.py`:
SERVER_MODE = False

Caveats: Omitting saved passwords requires users to manually input database credentials on each new session. Disabling server mode restricts pgAdmin to a local single-user instance and disables multi-user web hosting. Restarting the pgAdmin service or container to apply configuration changes will terminate active user sessions.

Understanding the Weakness (CWE)

CWE-214

Confidentiality

Technical Impact: Read Application Data

When this data contains sensitive information such as credentials, it might allow other users to launch an attack against the product or related resources.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.