EUVD lists pgAdmin 4 session flaw after password change (EUVD-2026-114392)

Summary

The EUVD entry, as relayed on Mastodon, says pgAdmin 4 did not invalidate existing sessions when a user's password changed, whether by the user or an administrator reset. It gives a CVSS v3.1 score of 2.3/10 and a last-updated date of 2026-10-30.

If you use pgAdmin

Update pgAdmin 4 to the fixed version named in EUVD-2026-114392

Log out all active pgAdmin sessions after any password change or reset

Review existing sessions for accounts whose passwords were recently changed

Update pgAdmin 4 to the fixed version named in EUVD-2026-114393

Restrict who can create or refresh materialized views through pgAdmin until patched

Review pgAdmin server configurations for unexpected connection parameters

What the sources say 15

Oct 30, 2026, 9:01 PM UTC · Mastodon: “pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged.” Source

Oct 30, 2026, 9:01 PM UTC · Mastodon: “pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management.” Source

Oct 30, 2026, 9:02 PM UTC · Mastodon: “In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name.” Source

Oct 30, 2026, 9:02 PM UTC · Mastodon: “In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but get_complete_file_path() only stripped leading slashes before joining the two.” Source

Oct 30, 2026, 9:02 PM UTC · Mastodon: “The create and update endpoints of the server API, however, stored the "shared" flag and shared username” Source

Oct 30, 2026, 9:02 PM UTC · Mastodon: “When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system accou” Source

Oct 30, 2026, 9:02 PM UTC · Mastodon: “To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility.” Source

Oct 30, 2026, 9:02 PM UTC · Mastodon: “In server mode any user could set a server's Service, or ...” Source

Oct 30, 2026, 9:02 PM UTC · Mastodon: “When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system ...” Source

Oct 30, 2026, 9:02 PM UTC · Mastodon: “In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SHARED_STORAGE ...” Source

Oct 30, 2026, 9:02 PM UTC · Mastodon: “pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that account's ~/.s...” Source

Oct 30, 2026, 9:02 PM UTC · Mastodon: “The check rejected a backslash inside a single-quoted string...” Source

Oct 30, 2026, 9:03 PM UTC · Mastodon: “Several callers then acted on a path they built differently, so the path checked and the p...” Source

Oct 30, 2026, 9:03 PM UTC · Mastodon: “After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username...” Source

Oct 30, 2026, 9:03 PM UTC · Mastodon: “The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including ...” Source