Description
To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environment is shared by every user's requests and copied into every process it starts, so in server mode another user's later PSQL session or utility inherited the password, and libpq used PGPASSWORD for any connection made without a password of its own, letting one user connect with another user's saved password.

The fix puts the password only into the environment built for the process that needs it and starts psql with a copy of pgAdmin's environment instead of the environment itself.

This issue affects pgAdmin 4: before 9.19.
Published: 2026-10-30
Score: 7 High
EPSS: n/a
KEV: No
Impact: Credential Disclosure Leading to Unauthorized Access
Action: Immediate Patch
AI Analysis

Impact

pgAdmin 4 prior to 9.19 stores database passwords in process environment variables, using PGPASSWORD for psql and custom per‑process variables. These variables are not cleared after use and are inherited by background processes, leaving the credentials accessible to any user who can spawn a child process of pgAdmin or read its environment.

Affected Systems

All installations of pgAdmin 4 older than version 9.19 are affected. The issue arises in environments where multiple users run pgAdmin on a shared host, or when pgAdmin launches background utilities such as psql or other command‑line tools. It does not impact newer releases.

Risk and Exploitability

The CVSS score of 7.0 indicates a medium severity. EPSS information is unavailable, but the lack of a KEV listing suggests no widespread exploitation yet. Nevertheless, any local attacker on the same host who can spawn a child process of pgAdmin can read the leaked password from the process environment, enabling them to authenticate to the database on behalf of another user.

Generated by OpenCVE AI on October 30, 2026 at 21:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade pgAdmin 4 to version 9.19 or later, which confines passwords to the environment of the child process only.
  • Until an upgrade is possible, run the pgAdmin server under a dedicated, least‑privileged user account and restrict the process group so that other local users cannot read its environment.
  • Avoid running pgAdmin in a multi‑user mode on a shared host; instead launch separate pgAdmin instances or limit the scope of background utilities to public sessions only.

Generated by OpenCVE AI on October 30, 2026 at 21:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Pgadmin
Pgadmin pgadmin 4
Vendors & Products Pgadmin
Pgadmin pgadmin 4

Fri, 30 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Description To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environment is shared by every user's requests and copied into every process it starts, so in server mode another user's later PSQL session or utility inherited the password, and libpq used PGPASSWORD for any connection made without a password of its own, letting one user connect with another user's saved password. The fix puts the password only into the environment built for the process that needs it and starts psql with a copy of pgAdmin's environment instead of the environment itself. This issue affects pgAdmin 4: before 9.19.
Title pgAdmin 4: Server passwords are left in pgAdmin's process environment
Weaknesses CWE-214
CWE-526
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N'}

cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N'}

Subscriptions

Pgadmin Pgadmin 4
cve-icon MITRE

Status: PUBLISHED

Assigner: PostgreSQL

Published:

Updated: 2026-10-30T19:55:16.276Z

Reserved: 2026-10-25T16:26:16.419Z

Link: CVE-2026-116246

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T20:17:04.603

Modified: 2026-10-30T20:17:04.603

Link: CVE-2026-116246

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T22:00:15Z

Weaknesses
  • CWE-214

    Invocation of Process Using Visible Sensitive Information

  • CWE-526

    Cleartext Storage of Sensitive Information in an Environment Variable