pgAdmin 4 EUVD-2026-114390

Exploitation requires pgAdmin 4 running in server (multi-user web) mode - desktop/single-user installations are not affected. The attacker needs an authenticated pgAdmin account (PR:L) and the ability to set a connection file path through the server dialog, the REST API, or a servers.json import. The key limiting factor (reflected by AT:P) is that the targeted file - another user's .pgpass, SSL certificate, key, CRL, or SSH identity file - must actually exist at a guessable location inside another user's storage directory for credential theft to succeed; for the sslkeylogfile vector, a path outside storage must be writable by the OS account running pgAdmin. High attack complexity (AC:H) reflects the crafting of traversal paths or smuggled libpq keyword=value pairs that survive the pre-fix quoting of values-but-not-names. No user interaction is required (UI:N).

This is a credible but not emergency-grade priority, consistent with the 'this_week' decision label. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N, score 7.2) describes a network-reachable but authenticated (PR:L) flaw that requires both high attack complexity (AC:H) and a specific attack precondition (AT:P) - namely that a targeted victim file (another user's .pgpass, SSL key, client cert, CRL or SSH identity) actually exists at a predictable location in another user's storage directory. The high confidentiality and subsequent-system impact (VC:H, SC:H, SI:H) are well-justified: the source diff confirms an attacker-controlled relative path resolved to another user's saved credentials and that those credentials were then used to connect, so a low-privileged pgAdmin user can pivot into another user's database sessions. No EPSS score was supplied and this CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation - exploitation status is best characterized as no public exploit identified at time of analysis (the only references are the fix commit and the issue tracker, not weaponized exploit code). The real-world risk is gated hard by deployment mode: this only affects pgAdmin running in multi-user server mode, so single-user desktop installations are not exposed. Net: a genuine privilege/credential-theft issue worth patching this week, but its blast radius is limited to shared server-mode deployments, not a drop-everything internet-wide threat.

In a shared pgAdmin server-mode deployment, a low-privileged authenticated user creates or edits a server definition (via the server dialog, the REST API, or a servers.json import) and sets a file path such as '../<victim>/.pgpass' for the password file, SSL key, client certificate, CRL or SSH tunnel identity. When the attacker connects that server, pgAdmin resolves the path into the victim's storage directory and uses the victim's saved password, client certificate or SSH key, letting the attacker authenticate as the victim; alternatively the sslkeylogfile parameter is passed to libpq unchanged to create or append a file anywhere writable by the account running pgAdmin. No public exploit code was identified, but the triggering mechanism is fully documented in the fix commit diff.