CVE-2026-116252
Description
A flaw was found in pgAdmin 4. When a user refreshes a materialized view, the database name is passed to the underlying database client without proper sanitization, allowing connection parameters to be overridden. An authenticated attacker with database creation permissions can define a crafted database name that redirects the connection to an external server. This flaw primarily leads to information disclosure by exposing the connecting user's saved database password to the attacker-controlled endpoint.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To reduce exposure to this vulnerability, apply operational and network controls:
1. Revoke database creation privileges: Prevent untrusted users from defining crafted database names by removing the CREATEDB attribute in PostgreSQL:
ALTER ROLE <username> NOCREATEDB;
2. Restrict outbound network access: Use firewall rules to restrict egress traffic from the host running pgAdmin 4, permitting outbound connections only to trusted PostgreSQL database servers and designated ports.
3. Avoid saving credentials: Do not store database passwords in pgAdmin's connection manager; require users to input credentials interactively during each session.
Caveat: Revoking database creation privileges prevents non-administrative users from creating new databases, which may impact development workflows. Modifying role permissions in PostgreSQL takes effect immediately and does not require a service restart or reload.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic; Read Application Data; Modify Application Data
If an attacker can provide an untrusted input that contains argument-separating delimiters, then the resulting command will have more arguments than intended by the developer, potentially changing the expected behavior of the command. Depending on the functionality supported by the extraneous arguments, this may have security-relevant consequences. The attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified, or cause other unintended behavior.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
