Do Son 
TL;DR
The PostgreSQL development team released pgAdmin 4 version 9.19 on October 29, 2026. This update remediates 15 critical pgAdmin 4 vulnerabilities. These flaws expose systems to remote code execution and credential theft. Therefore, database administrators must upgrade their server and desktop deployments immediately.
- Total: 15 CVEs
- Severity: 2 Critical · 11 High · 2 Medium
- Actively exploited: None confirmed
- Highest severity: 9.9 (Critical · CVSSv3) — CVE-2026-116241
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-116241 | 9.9 | Import/Export Data query export runs a command through a backslash in a double-quoted identifier | 9.19 | Not exploited |
| CVE-2026-116239 | 8.5 | An LDAP or Kerberos login is logged in to another account with the same username | 9.19 | Not exploited |
| CVE-2026-116249 | 8.4 | Connection file paths and parameter keys escape the user's storage directory | 9.19 | Not exploited |
| CVE-2026-116242 | 8.2 | SSH tunnels use the pgAdmin service account's own SSH identity | 9.19 | Not exploited |
| CVE-2026-116244 | 8.2 | libpq uses the pgAdmin service account's Kerberos credentials | 9.19 | Not exploited |
| CVE-2026-116245 | 8.2 | Connection services are not restricted in server mode | 9.19 | Not exploited |
| CVE-2026-116247 | 8.2 | libpq uses the pgAdmin service account's own password file and client certificate | 9.19 | Not exploited |
| CVE-2026-116238 | 8.1 | The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks | 9.19 | Not exploited |
Why It Matters
pgAdmin is the most popular open-source administration platform for PostgreSQL. The software serves millions of developers and enterprise administrators worldwide. Many organizations deploy pgAdmin in server mode to provide centralized database management.
Consequently, flaws in pgAdmin threaten corporate databases and host operating systems. The newly discovered vulnerabilities allow attackers to hijack database sessions, steal saved server credentials, and run arbitrary system commands. However, the project team confirmed that no active exploitation in the wild has occurred. Furthermore, researchers have not published any public proof-of-concept exploit code for these issues.
How the Attack Works
The vulnerabilities span command injection, authentication bypasses, path traversal, and credential exposure across multiple components.
Command Injection and Code Execution
The most dangerous flaw is CVE-2026-116241, which carries a critical 9.4 CVSS score. In the Import and Export Data tool, pgAdmin wraps export queries inside a psql copy command. While the parser previously blocked backslashes in single-quoted strings, it failed to restrict backslashes within double-quoted identifiers. An attacker can turn off standard conforming strings and escape the query wrapper. This allows the attacker to execute arbitrary operating system commands on the pgAdmin host using a crafted program clause.
Additionally, CVE-2026-116243 allows an attacker to upload an executable file into shared storage. The user can then point the binary path in preferences to that file. On Windows servers, the application executes the binary with the privileges of the pgAdmin service account.
Authentication Bypasses and Identity Collisions
Several flaws break authentication boundaries. In CVE-2026-116238, an unauthenticated attacker can bypass failed login limits. The Flask-Security login view fails to count failed attempts, permitting brute-force password guessing against administrator accounts.
Meanwhile, CVE-2026-116239 causes severe account collisions in server mode. When users log in through LDAP or Kerberos, pgAdmin checks only the username. If that name matches an internal account, the system logs the user into the internal administrator profile. Furthermore, CVE-2026-116248 permits non-administrators to register a shared server visible to all users. Attackers can lure colleagues into connecting to a rogue server and capture their database passwords.
Credential Leaks and Environment Exposure
Multiple flaws leak database credentials. For example, CVE-2026-116246 leaves plain passwords stored in process environment variables. Subsequent psql sessions started by other users can inherit these credentials.
In CVE-2026-116252, refreshing a materialized view passes an unsanitized database name to psql. If an attacker names a database using connection string parameters, the process redirects traffic to an external host. That rogue host then captures the victim’s saved server password. Finally, path traversal flaws CVE-2026-116240, CVE-2026-116249, and CVE-2026-116250 permit unauthorized file access across user directories.
Affected Versions
All 15 pgAdmin 4 vulnerabilities affect pgAdmin 4 versions prior to 9.19. These flaws primarily impact deployments operating in server mode on Linux and Windows platforms.
Patch and Mitigation Steps
The pgAdmin development team resolved all 15 security issues in the version 9.19 release. Administrators can review the changes in the official pgAdmin news announcement. Users should visit the official pgAdmin download portal and update their software immediately.
If an immediate upgrade is impossible, administrators should restrict network access to the pgAdmin web interface. Additionally, operators should disable shared storage directories and enforce strong perimeter network controls.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
