{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-116246","assignerOrgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","state":"PUBLISHED","assignerShortName":"PostgreSQL","dateReserved":"2026-10-25T16:26:16.419Z","datePublished":"2026-10-30T19:55:16.276Z","dateUpdated":"2026-10-30T19:55:16.276Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","shortName":"PostgreSQL","dateUpdated":"2026-10-30T19:55:16.276Z"},"title":"pgAdmin 4: Server passwords are left in pgAdmin's process environment","datePublic":"2026-10-29T00:00:00.000Z","affected":[{"vendor":"pgadmin.org","product":"pgAdmin 4","repo":"https://github.com/pgadmin-org/pgadmin4","modules":["PSQL Tool","Backup","Restore","Import/Export Data","Maintenance"],"programFiles":["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py","https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/bgprocess/processes.py","https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/psql/__init__.py"],"versions":[{"status":"affected","version":"0","lessThan":"9.19","versionType":"custom"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environment is shared by every user's requests and copied into every process it starts, so in server mode another user's later PSQL session or utility inherited the password, and libpq used PGPASSWORD for any connection made without a password of its own, letting one user connect with another user's saved password.\n\nThe fix puts the password only into the environment built for the process that needs it and starts psql with a copy of pgAdmin's environment instead of the environment itself.\n\nThis issue affects pgAdmin 4: before 9.19."}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/10653","tags":["issue-tracking"]},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/0eefa38f774dce07c1f939d87f2993b36e2313b9","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"Requires the PSQL tool to be enabled (ENABLE_PSQL) and another user to have used it (User Interaction Required), and the attacker's connection or utility to follow in the same pgAdmin process (Attack Complexity High). The gain is real only for users without the PSQL tool permission: a user who has it already holds a shell as the pgAdmin account. Scope is Changed because the password belongs to another user; Confidentiality is High for it. Integrity is Low, reflecting that the attacker's use of the other user's database identity is constrained by these conditions; Availability is None."}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":6.5,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"Same reasoning as the CVSS 3.1 entry. AT:P for the timing and configuration conditions, UI:P because the victim only has to use the PSQL tool. VC:H for the leaked password; SC:H/SI:L for the database server it opens."}],"cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N","baseScore":7,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-214 Invocation of Process Using Visible Sensitive Information","cweId":"CWE-214","type":"CWE"},{"lang":"en","description":"CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable","cweId":"CWE-526","type":"CWE"}]}],"credits":[{"lang":"en","value":"Dave Page <dpage@pgadmin.org>","type":"remediation developer"},{"lang":"en","value":"Kundan Sable <kundan.sable@enterprisedb.com>","type":"remediation reviewer"},{"lang":"en","value":"Ashesh Vashi <ashesh.vashi@enterprisedb.com>","type":"remediation reviewer"}],"source":{"discovery":"INTERNAL"}}}}