CVE-2026-116252

The record

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the host, port and other settings pgAdmin had supplied. A database whose name is such a string, which any role with CREATEDB can create, therefore redirected the psql process pgAdmin starts for the refresh to a host and port of the creator's choosing, and the connecting user's saved server password was presented to that endpoint. It also let the pgAdmin host be made to open connections to arbitrary addresses. The same weakness was fixed for Backup, Restore, Maintenance and Import/Export Data in earlier releases (CVE-2026-86862); the materialized view refresh was the remaining caller. The fix routes the name through the same database_conninfo() helper, so libpq treats it strictly as a database name. This issue affects pgAdmin 4: before 9.19.

Affected packages

Related vulnerabilities

• CVE-2026-62968 Dream Displays provides in-game screens for streaming videos in Minecraft. CWE-88
• CVE-2026-111504 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization… CWE-88
• CVE-2026-119282 Nx is a monorepo solution for TypeScript and polyglot codebases. CWE-88
• CVE-2026-90868 An OS command injection vulnerability in Progress Software WS_FTP Server versions prior… CWE-88
• CVE-2026-90865 An OS command injection vulnerability in Progress Software WS_FTP Server versions prior… CWE-88
• CVE-2026-50056 A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra… CWE-88
• CVE-2026-115372 Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows… CWE-88
• CVE-2026-111813 Apache Traffic Server's experimental magick plugin lets an unauthenticated client control… CWE-88