CVE-2026-116244: Kerberos Authentication Bypass in pgAdmin 4

pgAdmin 4: Kerberos authentication bypass. Users can impersonate the service account in server mode. CVSS 8.2.

CVE-2026-116244 is an authentication vulnerability in pgAdmin 4 server mode. When a Kerberos connection was not configured to delegate credentials, pgAdmin removed KRB5CCNAME from its environment. libpq fell back to the service account's Kerberos ticket. Any user could thus connect as the service account's Kerberos principal, gaining full access to data and associated privileges.

CVSS 8.2 (high). Published October 30, 2026 on NVD. Proof of concept and containerized lab on GitHub on October 31, confirming reproducibility. On Windows, the same vulnerability affects SSPI. Disabling gssencmode did not provide protection.

Update pgAdmin 4 to v9.19+ immediately. If not possible, configure require_auth=!gss,!sspi and gssencmode=disable on all connections. Examine PostgreSQL logs for anomalous logins as the service account. In Kerberos environments, immediately audit the service account's password/keytab.

At a glance

What: In pgAdmin 4 server mode, when a Kerberos connection was not meant to use delegated credentials, pgAdmin removed KRB5CCNAME from its environment. libpq would answer server GSSAPI requests with pgAdmin's service account ticket, regardless of the user name provided. Any user could thus connect as the service account's Kerberos principal. On Windows, the same occurred with SSPI.
Severity: CVSS 8.2 (high). Impacts authentication at the core: unauthorized access with service account privileges in server mode.
Affected versions: pgAdmin 4 before version 9.19
Fix: Update to pgAdmin 4 version 9.19 or later. The patch points KRB5CCNAME and KRB5_CLIENT_KTNAME to non-existent files outside Kerberos-authenticated connections, and applies require_auth=!gss,!sspi and gssencmode=disable on all other connections.
Status: Published in NVD on October 30, 2026. Proof of concept and containerized lab available in GitHub repositories as of October 31. Fix confirmed in version 9.19.
Action: 1) Update pgAdmin 4 to v9.19+ immediately. 2) If update is not possible, disable GSSAPI/SSPI authentication (require_auth=!gss,!sspi and gssencmode=disable). 3) Review PostgreSQL logs for anomalous logins as service account in recent months. 4) In Kerberos environments, immediately audit the pgAdmin service account credentials.

Sources: NVD, CVE-2026-116244

← All articles