BlackSight Discovers CVSS 8.9 Vulnerability in pgAdmin 4

The vulnerability could allow a user with valid LDAP or Kerberos credentials to enter another person's pgAdmin account, potentially gaining administrative privileges and access to saved database connections. The pgAdmin maintainers publicly acknowledge Yves Soete of Blacksight LLC for reporting the issue, which is fixed in pgAdmin 4 v9.19.

A valid login. More access than intended.

In affected configurations, pgAdmin could authenticate a user through LDAP or Kerberos and then associate the session with a different account. That account could be the internal administrator, or another user whose identity was incorrectly selected during the login process. The session inherited the selected account's privileges, servers, and saved database passwords. The vendor's public advisory describes the account confusion.

For an organization, that creates a potential path from an ordinary authenticated user to more privileged access. The extent depends on the account reached and the permissions of its database connections. This is why authentication and authorization need to be tested together: a system must verify both who is signing in and which access belongs to that identity.

Discovered during a BlackSight penetration test

Yves S. Soete identified the vulnerability during one of BlackSight's penetration tests. The finding illustrates the value of examining what happens after a successful login: how the application selects an account, assigns privileges, and separates users who authenticate through different sources.

A login page accepting the correct credentials is only one part of the security picture. An assessment should also establish whether a user can cross into another account, inherit a higher role, or reach systems beyond their intended permissions. These are the kinds of boundaries that BlackSight's manual penetration testing is designed to examine.

For our customers, the value is practical: evidence of where access controls can fail, an explanation of the business impact, and a clear path to remediation. This discovery is a public example of that work, with a vendor-confirmed vulnerability and a released fix.

Who is affected?

The published affected range covers pgAdmin 4 versions before 9.19. Exploitation concerns server-mode deployments using LDAP or Kerberos and requires valid credentials in the configured directory or realm, together with specific account-matching or authentication-order conditions. Desktop mode is unaffected. The PostgreSQL CNA assigns the issue a CVSS 4.0 score of 8.9, rated High. View the official CVE record.

From a pentest finding to a public fix

The pgAdmin team addressed the issue in version 9.19, released on October 29, 2026. Account selection now checks the authenticated username and its authentication source, keeping the session tied to the identity that actually signed in. The release notes also credit Yves Soete of Blacksight LLC for the report. Read pgAdmin's release notes.

CVE-2026-116239 was published on October 30, 2026. We thank the pgAdmin maintainers for addressing the finding and acknowledging the research. The result extends beyond the original assessment: organizations running affected deployments now have a fix they can apply.

What organizations should do now

• Identify affected deployments. Check your pgAdmin version, deployment mode, and configured authentication sources.
• Upgrade to 9.19 or a later fixed release. Review the release notes, including the account changes needed for users who previously landed in an internal account with the same name.
• Verify access after the upgrade. We recommend checking that each login receives the intended account, role, and database access, particularly where multiple authentication sources are enabled.

If your applications combine directory logins, local accounts, or several user roles, include those boundaries in your next security assessment. BlackSight can help you establish where legitimate access could become unintended privilege.