Database Redirection Vulnerability in pgAdmin 4 by pgAdmin Development Team

CVE-2026-86862

What is CVE-2026-86862?

The pgAdmin 4 Restore and Maintenance tools improperly handle the 'database' field provided by clients, allowing an authenticated user to redirect database connections to a malicious server. This vulnerability arises when the database name contains an equals sign, leading libpq to treat it as a full connection string. As a result, connection parameters can override the intended host and port settings, potentially exposing sensitive credentials and enabling connections to unauthorized endpoints. The vulnerability also allows the executed utilities to use the decrypted database password stored in the PGPASSWORD environment variable, significantly increasing security risks. The issue has been resolved in pgAdmin 4 by ensuring that the database name is set securely in the PGDATABASE environment variable instead of passing user input directly.

References