CVE-2026-116240

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

CVE-2026-116239 pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's...

CVE-2026-116240 pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

CVE-2026-116239

In pgAdmin 4 (versions before 9.19) running in server mode, an improper authentication flaw allows users authenticated via LDAP or Kerberos to be logged into different accounts if those accounts share the same username as an internal account. This occurs because the system failed to verify that t...

CVE-2026-116240 pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

EUVD-2026-114380

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's...

CVE-2026-116240

In server mode, pgAdmin 4 (versions before 9.19 ) is vulnerable to path traversal and TOCTOU issues due to inconsistent path handling in check_access_permission(). The system validates one path but subsequently acts on a differently constructed path. Specifically, stripping slashes can allow acce...

EUVD-2026-114381

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

CVE-2026-116239

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's...

CVE-2026-116238

In server mode pgAdmin 4 locks an internal account after MAXLOGINATTEMPTS failed logins 3 by default. The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: ...

CVE-2026-116239: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an…

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's...

CVE-2026-116240: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which…

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

CVE-2026-116247: pgadmin.org pgAdmin 4: When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one…

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running pgAdmin: /.pgpass,...

PT-2026-134155

pgAdmin 4 runs pg dump, pg restore, pg dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGE DIR, not under a SHARED STORAGE directory, which ordinary users can upload files...

PT-2026-134154

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host pkey directories nor ssh config file, so it always loaded the unencrypted private keys in /.ssh of the operating-system account running pgAdmin, read that account's /.ssh/config IdentityFile, User, HostName,...

CVE-2026-116250: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with…

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with checkaccesspermission and then opened it by name. Several places opened it with a plain open or handed the path to a utility that opened it later: the servers.json export and import and the import fi...

PT-2026-134152

In server mode pgAdmin 4 validates a path into the user's storage directory with check access permission, which builds the absolute path with get abs path. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a fi...

PT-2026-134159

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running pgAdmin: /.pgpass,...

CVE-2026-116249: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file…

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "../ /.pgpass", set through the server dialog,...

CVE-2026-116248: pgadmin.org pgAdmin 4: In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the…

In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the "shared" flag and shared username they were sent, so any user able to register a...