CVEspgadmin.orgCVE-2026-116252Published Oct 30, 19:55 · Updated Oct 30, 19:55 UTC
6.5
MediumCVSS 3.1 · from PostgreSQL
CVE-2026-116252

pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name

pgAdmin 4 · CWE-88 · CWE-88
AffectedpgAdmin 4
FixUpdate to 9.19 or newer
PublishedOct 30, 19:55 · PostgreSQL
ScoredOct 30 · 6.5 · PostgreSQL
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC

What we know

No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read data. CVSS impact.

Description

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the host, port and other settings pgAdmin had supplied. A database whose name is such a string, which any role with CREATEDB can create, therefore redirected the psql process pgAdmin starts for the refresh to a host and port of the creator's choosing, and the connecting user's saved server password was presented to that endpoint. It also let the pgAdmin host be made to open connections to arbitrary addresses. The same weakness was fixed for Backup, Restore, Maintenance and Import/Export Data in earlier releases (CVE-2026-86862); the materialized view refresh was the remaining caller. The fix routes the name through the same database_conninfo() helper, so libpq treats it strictly as a database name. This issue affects pgAdmin 4: before 9.19.

From PostgreSQL

Affected and fixed versions

ProductAffectedFixed inpgAdmin 4before 9.199.19

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

github.com/pgadmin-org/pgadmin4/issues/10645 · github.comissue trackinggithub.com/pgadmin-org/pgadmin4/commit/a1a43e8c28cf10cec73df0c476905562d19af483 · github.compatch

Other CVEs in pgAdmin 4

All 55 →
4.2pgAdmin 4: A user's other sessions survive a change of their password · CVE-2026-116251Oct 306.5pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check · CVE-2026-116250Oct 308.4pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory · CVE-2026-116249Oct 30