pgAdmin 4 EUVD-2026-114386

Exploitation is limited to pgAdmin 4 running in server (multi-user web) mode - desktop mode is explicitly not affected because any service may be used by the single local user there. It additionally requires that the operating-system account running pgAdmin has usable credentials for the attacker to inherit: a connection service file (~/.pg_service.conf, or a file named by PGSERVICEFILE/PGSYSCONFDIR) containing an entry with a password, password file, or client certificate, and/or PGPASSWORD or PGSERVICE environment variables set for that account, and/or pg_dumpall being invoked with a 'service=...' maintenance database name. The actor must be an authenticated pgAdmin user (CVSS PR:L), who then sets a server's Service, a 'service'/'servicefile' connection parameter, to one of those entries. Limiting factors: no such credentials present on the host account means nothing to steal; the attack is authenticated and not available to anonymous remote attackers; and it is high-complexity because it depends on host-side configuration the attacker cannot directly set.

This is a credential-exposure/privilege-escalation issue (CWE-522) scoped to pgAdmin 4 server mode, not a mass-exploitable remote flaw. The supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N, score 7.1 High) tells a consistent story: although the attack surface is network-reachable (AV:N), it requires an already-authenticated low-privileged pgAdmin user (PR:L), carries an attack requirement (AT:P) and high complexity (AC:H) because it depends on preconditions the attacker does not control - namely that the OS account running pgAdmin actually has a connection service file entry, PGPASSWORD/PGSERVICE set, or pg_dumpall in use. The high confidentiality and subsequent-system impact (VC:H, SC:H/SI:H) reflects that a user can harvest another identity's stored password/certificate and act on a database with it. No CISA KEV listing and no EPSS score were provided, so widespread opportunistic exploitation cannot be asserted; the only references are the fix commit and the GitHub issue, which are not working exploit code. Signals do not conflict: a moderately high severity for an authenticated multi-tenant abuse, with the vuln.today 'this_week' priority indicating it warrants prompt patching rather than emergency response. The main caveat is missing EPSS/KEV data, which limits confidence in real-world exploitation frequency.

In a shared pgAdmin 4 server-mode deployment, a low-privileged but authenticated pgAdmin user creates or edits a server and sets its Service (or a 'service' connection parameter) to an entry present in the service account's ~/.pg_service.conf, causing libpq to connect using that entry's stored password, password file, or client certificate. By also overriding the entry's host, the user can redirect that connection to a PostgreSQL server they control and capture the inherited password/certificate. No public working exploit was identified at time of analysis; the available references are the vendor fix commit and the GitHub issue, not proof-of-concept exploit code.