pgAdmin 4 9.19 fixes 15 security vulnerabilities, including OS command injection

Key points

• pgAdmin 4 v9.19 fixes 136 bugs and adds features, including patches for 15 security vulnerabilities (CVE-2026-116238 through CVE-2026-116252).
• One fix closes an OS command injection in the Import/Export Data tool (CVE-2026-116241), which completes an earlier, incomplete fix for CVE-2026-17566. Several others let a user connect with another user’s credentials or have pgAdmin execute a file they placed in shared storage.
• Server mode gets administrator-defined allowlists: SERVER_PASSEXEC_COMMANDS must be configured before the first start after upgrading, and SERVER_MODE_ALLOWED_SERVICES restricts connection services.

The pgAdmin Development Team has released pgAdmin 4 version 9.19. pgAdmin is the leading open-source graphical management tool for PostgreSQL. This release contains 136 bug fixes and new features, including fixes for 15 security vulnerabilities numbered CVE-2026-116238 through CVE-2026-116252. Builds for Windows and macOS are available now, along with a Python Wheel, Docker container, RPM, DEB package, and source tarball.

Details

CVE-2026-116241 is an OS command injection in the Import/Export Data tool. A query-based export could smuggle a live TO PROGRAM clause past the \copy parenthesis guard using a backslash inside a double-quoted identifier, running an arbitrary command on the pgAdmin host. This fix completes an earlier, incomplete fix for CVE-2026-17566.

A group of fixes targets account and authentication abuse. CVE-2026-116239 fixes LDAP and Kerberos authentication logging a user into a different account that shared their username, including the initial administrator. CVE-2026-116238 fixes bypasses of the failed-login limit and of pgAdmin’s own login, password-change and password-reset checks, through Flask-Security’s own views and through username case and second-source handling. CVE-2026-116251 stops a user’s other sessions surviving a password change or administrator reset.

Several fixes address cross-user access in server mode. CVE-2026-116249 fixes connection file paths and parameter keys escaping the user’s storage directory, which let a user connect with another user’s credentials or key. CVE-2026-116248 stops any user able to register a server from sharing it with every other user. CVE-2026-116243 fixes the utility binary-path guard accepting a path under SHARED_STORAGE, which let a user have pgAdmin execute a file they placed there. CVE-2026-116240 fixes the File Manager and storage-path tools acting on a different path from the one checked. CVE-2026-116250 fixes time-of-check to time-of-use symlink, hard-link and FIFO races in the File Manager, Import/Export Servers, Backup, Restore and Import/Export Data file paths.

More hardening removes service-account privileges from user connections. libpq no longer falls back to the pgAdmin service account’s password file and client certificate (CVE-2026-116247) or its Kerberos credentials (CVE-2026-116244). SSH tunnels no longer use the service account’s own SSH identity (CVE-2026-116242). Server passwords are no longer left in pgAdmin’s process environment, where another user’s session or utility could inherit them (CVE-2026-116246). A crafted database name in materialized view refresh can no longer be expanded into a full connection string (CVE-2026-116252). Free-text Password Exec Commands in server mode are replaced with an administrator-defined allowlist, SERVER_PASSEXEC_COMMANDS; the commands run without a shell and with a reduced environment. Connection services in server mode are restricted to the SERVER_MODE_ALLOWED_SERVICES allowlist (CVE-2026-116245).

Beyond security, v9.19 adds a Statistics node for extended statistics, editing data through simple auto-updatable views, saving Query Tool results as JSON or XML with selectable encoding and optional BOM, and pg_timetable chain and task management. The login page can be skipped when OAuth2 is the only authentication source, and pgEdge Starfleet joins the Deploy Cloud Instance wizard. Notable bug fixes include Schema Diff issues (SERIAL/BIGSERIAL conversions, renamed function arguments, false differences caused by a dropped column), generated-column handling in View/Edit Data, the MAINTAIN privilege being silently dropped for views and materialized views on PostgreSQL 17 and later, and a stray Python copy in Linux packages that stopped the DEB package installing on Ubuntu 26.04.

Background

pgAdmin is the leading open-source graphical management tool for PostgreSQL, and its server mode hosts many users on one instance. Many of the patched CVEs involve one user reaching another user’s credentials, sessions, or files.

Why it matters

If you run pgAdmin in server mode, the command injection fix (CVE-2026-116241) and the cross-user credential and session fixes are the ones to review first. The new allowlist settings also change startup behavior.

What to do

• Upgrade to pgAdmin 4 v9.19.
• Configure SERVER_PASSEXEC_COMMANDS before the first start after upgrading; free-text password exec commands no longer work.
• Define SERVER_MODE_ALLOWED_SERVICES if you need connection services in server mode.
• If OAuth2 is your only authentication source, expect the login page to be skipped.