PatchTheCVECVE-2026-116246: To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server ma
CVE-2026-116246 is a medium-severity flaw (CVSS 6.5) affecting pgadmin 4. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environment is shared by every user's requests and copied into every process it starts, so in server mode another user's later PSQL session or utility inherited th
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Last updated 2026-11-04 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- VulDB Recent Entries: CVE-2026-116246 | pgadmin.org pgAdmin 4 up to 9.18 Environment Variable access control 2026-10-30
- Vulners Bulletins: CVE-2026-116246 2026-10-30
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-116246?
pgadmin 4: upgrade to 9.19. Exact commands for each OS are on this page.
Is CVE-2026-116246 being exploited?
CVE-2026-116246 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-116246 affect?
CVE-2026-116246 affects pgadmin 4. Severity is medium (CVSS 6.5). To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a uti
How urgent is CVE-2026-116246?
Priority 25/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-116241 CRITICAL 9.9 UPGRADE pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks th
- CVE-2026-116239 HIGH 8.5 UPGRADE In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for ex
- CVE-2026-116240 MEDIUM 6.5 UPGRADE In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), wh
- CVE-2026-116242 HIGH 8.2 UPGRADE pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_confi
- CVE-2026-116243 HIGH 7.5 UPGRADE pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences