PatchTheCVECVE-2026-116247: When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configure
CVE-2026-116247 is a high-severity flaw (CVSS 8.2) affecting pgadmin 4. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running pgAdmin: ~/.pgpass, ~/.postgresql/postgresql.crt and postgresql.key, or PGPASSFILE, PGSSLCERT and PGSSLKEY. In server mode any user could therefore connect to a server with the service acco
Why this priority
- High severity
A fixed release or distro patch exists.
Last updated 2026-11-04 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- VulDB Recent Entries: CVE-2026-116247 | PostgreSQL pgAdmin up to 9.18 information disclosure 2026-10-30
- Vulners Bulletins: CVE-2026-116247 2026-10-30
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-116247?
pgadmin 4: upgrade to 9.19. Exact commands for each OS are on this page.
Is CVE-2026-116247 being exploited?
CVE-2026-116247 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-116247 affect?
CVE-2026-116247 affects pgadmin 4. Severity is high (CVSS 8.2). When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-sy
How urgent is CVE-2026-116247?
Priority 29/100. High severity
Software pages
Related CVEs
- CVE-2026-116241 CRITICAL 9.9 UPGRADE pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks th
- CVE-2026-116239 HIGH 8.5 UPGRADE In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for ex
- CVE-2026-116240 MEDIUM 6.5 UPGRADE In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), wh
- CVE-2026-116242 HIGH 8.2 UPGRADE pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_confi
- CVE-2026-116243 HIGH 7.5 UPGRADE pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences