pgAdmin 4 伺服器模式認證繞過漏洞（CVE-2026-116245）
CVE-2026-116245 - pgAdmin 4: Connection services are not restricted in server mode
pgAdmin 4 在伺服器模式下允許任何使用者透過服務檔案取得憑證，造成認證繞過風險。
- - 影響版本：9.19 之前。
- - 風險：未授權存取。
此漏洞揭示 pgAdmin 4 在伺服器模式下的認證繞過風險，任何使用者皆可透過服務檔案取得憑證，導致未授權存取。建議立即升級至 9.19 版並設定 SERVER_MODE_ALLOWED_SERVICES，以確保安全並在部署環境中啟用此設定，避免潛在的資料外洩風險。
libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's Service, or a "service" connection parameter, to one of those entries and connect with its credentials. A PGPASSWORD or PGSERVICE variable set for that account was likewise used by libpq for every connection without a value of its own and passed on to the utilities, and pg_dumpall read a maintenance database name such as "service=..." as a connection string. The fix adds the SERVER_MODE_ALLOWED_SERVICES setting, empty by default: in server mode only a listed service can be used, the servicefile parameter is refused, and PGPASSWORD and PGSERVICE are removed from pgAdmin's environment at startup. The allowlist is checked again on the final connection string, and the pg_dumpall database name is wrapped as a connection string. This issue affects pgAdmin 4: before 9.19.
Impact
Affected Products
The following products are affected by CVE-2026-116245
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | Pgadmin | pgadmin_4 |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | ||||
| CVSS 4.0 | HIGH | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 |
Update pgAdmin 4 to version 9.19 or later to address authentication bypass vulnerabilities.
- Update pgAdmin 4 to version 9.19 or later.
- Ensure SERVER_MODE_ALLOWED_SERVICES is configured properly.
- Remove PGPASSWORD and PGSERVICE from environment variables.
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-116245.
| URL | Resource |
|---|---|
| https://github.com/pgadmin-org/pgadmin4/commit/a0c8f4857f732c6f5e5bacf4b289b811bb5c6a06 | |
| https://github.com/pgadmin-org/pgadmin4/issues/10654 |
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-116245 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-116245
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-116245 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-116245 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
十月. 30, 2026
Action Type Old Value New Value Added Description libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's Service, or a "service" connection parameter, to one of those entries and connect with its credentials. A PGPASSWORD or PGSERVICE variable set for that account was likewise used by libpq for every connection without a value of its own and passed on to the utilities, and pg_dumpall read a maintenance database name such as "service=..." as a connection string. The fix adds the SERVER_MODE_ALLOWED_SERVICES setting, empty by default: in server mode only a listed service can be used, the servicefile parameter is refused, and PGPASSWORD and PGSERVICE are removed from pgAdmin's environment at startup. The allowlist is checked again on the final connection string, and the pg_dumpall database name is wrapped as a connection string. This issue affects pgAdmin 4: before 9.19. Added CVSS V4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N Added CWE CWE-522 Added CWE CWE-862 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/116xxx/CVE-2026-116245.json">CVE-2026-116245</a> Added Reference https://github.com/pgadmin-org/pgadmin4/commit/a0c8f4857f732c6f5e5bacf4b289b811bb5c6a06 Added Reference https://github.com/pgadmin-org/pgadmin4/issues/10654
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.