PatchTheCVECVE-2026-116244: When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5
CVE-2026-116244 is a high-severity flaw (CVSS 8.2) affecting pgadmin 4. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account running pgAdmin. libpq then answered any server that asked for GSSAPI authentication with that account's ticket, whatever user name the pgAdmin user gave, so in server mode any user could conn
Why this priority
- High severity
A fixed release or distro patch exists.
Last updated 2026-11-04 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- Vulners Bulletins: Exploit for CVE-2026-116244 2026-10-31
- VulDB Recent Entries: CVE-2026-116244 | pgadmin.org pgAdmin up to 9.18 Kerberos Credential default credentials 2026-10-30
- Vulners Bulletins: CVE-2026-116244 2026-10-30
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-116244?
pgadmin 4: upgrade to 9.19. Exact commands for each OS are on this page.
Is CVE-2026-116244 being exploited?
CVE-2026-116244 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-116244 affect?
CVE-2026-116244 affects pgadmin 4. Severity is high (CVSS 8.2). When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operati
How urgent is CVE-2026-116244?
Priority 34/100. High severity
Related CVEs
- CVE-2026-116241 CRITICAL 9.9 UPGRADE pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks th
- CVE-2026-116239 HIGH 8.5 UPGRADE In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for ex
- CVE-2026-116240 MEDIUM 6.5 UPGRADE In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), wh
- CVE-2026-116242 HIGH 8.2 UPGRADE pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_confi
- CVE-2026-116243 HIGH 7.5 UPGRADE pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences