libpq used by pgAdmin 4 reads a service entry from the operating‑system account’s service file. In server mode the application allows any user to set the service or service parameter to that entry, causing libpq to use stored passwords or certificates for authentication. Additionally, environment variables PGPASSWORD and PGSERVICE are automatically applied to connections that lack their own values, and utilities such as pg_dumpall treat the service name as a connection string. This behavior allows an attacker to obtain privileged database credentials or impersonate a database user without proper authorization, potentially leading to unauthorized data modification or disclosure.

pgAdmin 4 versions prior to 9.19, released by pgAdmin.org, are affected. The issue exists across all supported operating systems where the application runs in server mode, as the vulnerability stems from libpq’s handling of service files and environment variables rather than platform‑specific code. The vulnerability applies to the operating‑system account under which pgAdmin 4 runs.

The CVSS score is 7.1, indicating a moderate to high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting limited known exploitation. The likely attack vector is local or application‑level manipulation of the service name or environment variables while pgAdmin runs in server mode. The fix introduces a SERVER_MODE_ALLOWED_SERVICES allowlist and removes environment variables during startup, mitigating the risk of credential leakage.