pgAdmin 4 CVE-2026-116252

Requires an authenticated role (PR:L) holding the CREATEDB privilege on the target PostgreSQL server, used to create a database whose name is a valid libpq connection string - specifically one containing '=' or formatted as a postgresql:// URI - so libpq treats it as connection keywords overriding host and port. The high-impact credential disclosure further requires a pgAdmin user who has a saved server password to navigate into that database and trigger a materialized view refresh, which invokes psql with the malicious name as --dbname. LIMITING FACTORS: exploitation is gated on untrusted roles being granted CREATEDB (not default for ordinary users), on a victim pgAdmin session with a stored password performing the refresh, and on pgAdmin 4 versions before 9.19; the SSRF-style 'connect to arbitrary addresses' effect does not itself require the victim's saved password. The only complete fix is updating to 9.19, which wraps the name via database_conninfo().

This is a genuine but conditional credential-exposure flaw (CWE-88 argument injection) in pgAdmin 4, not a drive-by remote code execution. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and reflects network reach, low complexity, and pure confidentiality impact with no integrity or availability effect. The PR:L is the key limiter: an attacker must already hold a role with the CREATEDB privilege on the target PostgreSQL server to plant a database whose name is a libpq connection string. The description also makes clear that the high-value payoff - theft of a connecting user's saved server password - depends on a separate pgAdmin user actually refreshing a materialized view inside that malicious database, so meaningful victim interaction is involved even though the input vector lists UI:N (I diverge to UI:A/UI:R in my own assessment below). No CISA KEV listing and no EPSS score were provided, so there is no signal of active or probable widespread exploitation; the vuln.today decision label is 'this_week', indicating prompt-but-not-emergency remediation. No public exploit was identified - the only references are the vendor fix commit and the GitHub issue, which are not exploit code. Net: real priority for environments where untrusted roles hold CREATEDB, lower priority where database creation is tightly restricted.

An attacker holding a CREATEDB-capable PostgreSQL role creates a database whose name is a libpq connection string (e.g. containing '=' or a postgresql:// URI) pointing to a host and port they control. When a pgAdmin user who has saved their server password later refreshes a materialized view within that database, pgAdmin invokes psql with the crafted name as --dbname, libpq interprets it as a full connection string, and the user's saved password is transmitted to the attacker's endpoint; the pgAdmin host can likewise be coerced into connecting to arbitrary addresses. No public exploit was identified at time of analysis - only the fix commit and issue report are referenced.