SecBoard
Zurück zur CVE-Übersicht

CVE-2026-116244

HIGH(8.2)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Risk Signal Score21/100 — NIEDRIG
  • CVSS 8.2 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.2

Technische Schwere

Beschreibung

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account running pgAdmin. libpq then answered any server that asked for GSSAPI authentication with that account's ticket, whatever user name the pgAdmin user gave, so in server mode any user could connect as the service account's Kerberos principal; gssencmode=disable did not prevent it. On Windows, SSPI used the service account's logon in the same way. psql was also started with pgAdmin's environment, which could hold another user's credential cache while that user was connecting. The fix points KRB5CCNAME and KRB5_CLIENT_KTNAME at a file that cannot exist except while a Kerberos-authenticated user connects with Kerberos, and gives every other connection, psql and the utilities require_auth=!gss,!sspi and gssencmode=disable, checked on the final connection string. require_auth needs libpq 16 or later. This issue affects pgAdmin 4: before 9.19.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 9.19

Threat-Hunting-Queries

This vulnerability involves pgAdmin 4 using the service account's Kerberos credentials instead of the user's delegated credentials, allowing unauthorized access. Detection should focus on unusual Kerberos authentication patterns originating from the pgAdmin 4 service account, especially connections made with unexpected user names or to unauthorized resources.

Sentinel/Defender KQL

IdentityInfo
| where ServicePrincipalName contains "pgadmin"
| join kind=inner (AuditLogs
    | where OperationName == "UserLoggedIn"
    | where ResultType == "Success"
    | extend InitiatingProcessAccount = tostring(parse_json(InitiatedBy).user.userPrincipalName)
    | where InitiatingProcessAccount != UserPrincipalName
) on $left.AccountUPN == $right.InitiatingProcessAccount
| where isnotempty(ServicePrincipalName)
| project TimeGenerated, AccountUPN, ServicePrincipalName, InitiatingProcessAccount, UserPrincipalName, IPAddress, Application

Splunk SPL

sourcetype=kerberos (servicePrincipalName=*pgadmin* OR host=*pgadmin*) (authentication_type=gssapi OR authentication_type=kerberos) NOT (user=*pgadmin_service_account* AND user_delegated=true)
| stats count by _time, user, servicePrincipalName, host, client_ip
| where count > 1

Sigma

title: PgAdmin Kerberos Credential Misuse
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential misuse of pgAdmin service account Kerberos credentials for unauthorized access.
author: SecBoard
date: 2026/10/26
references:
  - https://github.com/pgadmin-org/pgadmin4/commit/145e511f05eed69ebcadd3cd61ffea0a5b4c69a4
logsource:
  product: linux
  service: auditd
detection:
  selection:
    EventID: 109
    ProcessName|endswith: 'pgadmin4'
    User: '*'
    TargetUser|startswith: 'pgadmin_service_account'
    AuthenticationMethod: 'Kerberos'
  condition: selection
fields:
  - User
  - TargetUser
  - ProcessName
  - AuthenticationMethod
level: high

Elastic ES|QL

from logs-kerberos-authentication*
| where service.name : "pgadmin*" or host.name : "pgadmin*"
| where event.action : ("gssapi_authentication", "kerberos_authentication")
| where not (user.name : "pgadmin_service_account" and kerberos.delegated_credentials : true)
| stats count() by @timestamp, user.name, service.name, host.name, source.ip
| where count > 1

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:*:*:*

Referenzen