pgAdmin 4 9.19: Fixes 15 CVEs, Including OS Command Injection

Login lockout and account selection in server mode #

In server mode, pgAdmin locks an internal account after MAX_LOGIN_ATTEMPTS failed logins, three by default. CVE-2026-116238 (CVSS 4.0 9.2, CRITICAL, assigned by PostgreSQL) says Flask-Security registers its own /login, /verify, /change and /reset views beside pgAdmin's, and those views skipped the failed-login count and pgAdmin's password checks. In the default configuration, an unauthenticated attacker could make an unlimited number of password guesses against any internal account, including the administrator's. The fix refuses submissions to Flask-Security's own views.

The same record describes two more paths around the count. The internal account was looked up by its exact username, while the login form matches email ignoring case, so a login typed in another case was neither counted nor checked for the lock. With LDAP or webserver authentication also configured, a wrong internal password was never counted. The fix counts every failed internal login however the username is typed and whatever other sources are configured.

CVE-2026-116239 (CVSS 8.9, HIGH, assigned by PostgreSQL) is an account-selection error. After LDAP or Kerberos authenticated a user, pgAdmin could log the session in to an internal account with the same username, including the administrator account created when pgAdmin is first set up. That session carries the account's role, servers and saved database passwords. Exploitation requires valid credentials for an LDAP directory or Kerberos realm that pgAdmin is configured to use. Desktop mode is not affected.

The announcement also lists CVE-2026-116251 as a fix for a user's other sessions surviving a password change or administrator reset. Taken together with the lockout fixes, a password reset in server mode now has to cover sessions that were previously left open, so the reset is the point where an administrator should confirm that sessions end.

Connections that reused the pgAdmin service account's credentials #

In server mode, the service account is the operating-system account that runs pgAdmin. CVE-2026-116247 (CVSS 7.1, HIGH) describes libpq falling back to that account's ~/.pgpass, ~/.postgresql/postgresql.crt and postgresql.key when a server had no password file or certificate configured, or the configured one could not be found. Supplying only a copy of the service account's public certificate was enough for libpq to pair it with the service account's private key. Desktop mode is unchanged.

CVE-2026-116244 (CVSS 7.1, HIGH) applies the same pattern to Kerberos. With KRB5CCNAME removed from pgAdmin's environment, libpq answered any server that asked for GSSAPI authentication with the service account's ticket, whatever user name was given. The record states that gssencmode=disable did not prevent it. The fix sets require_auth=!gss,!sspi and gssencmode=disable on connections that do not use a Kerberos user's credentials, and the record notes that require_auth needs libpq 16 or later.

CVE-2026-116242 (CVSS 7.1, HIGH) covers SSH tunnels. pgAdmin loaded unencrypted private keys from ~/.ssh, read ~/.ssh/config for the tunnel host, and could use the service account's ssh-agent. In server mode, tunnels now use only the identity file or password the user configured, and an identity file missing from the user's storage is reported instead of falling back to ~/.ssh. Desktop mode is unchanged.

CVE-2026-116245 (CVSS 7.1, HIGH) addresses connection services. A server's Service, or a "service" connection parameter, could name an entry in the service account's service file, which can hold a password or name a password file or client certificate. A PGPASSWORD or PGSERVICE variable set for that account was also used by libpq for every connection without a value of its own. CVE-2026-116246 (CVSS 7, HIGH) covers server passwords left in pgAdmin's process environment, where another user's later PSQL session or utility could inherit them.

OS command execution on the pgAdmin host through query export and binary paths #

CVE-2026-116241 is rated 9.4 (CRITICAL) by PostgreSQL and is OS command injection in Import/Export Data. pgAdmin wraps a query export in a psql \copy (...) TO command. A backslash inside a double-quoted identifier could make pgAdmin's and psql's quoting diverge, so a following TO PROGRAM clause ran on the pgAdmin host, as the account running pgAdmin, before the server rejected the statement. The record calls this a bypass of the fix for CVE-2026-17566.

The record also states that an ordinary database role can turn standard_conforming_strings off for itself, and that the Import/Export Data permission is granted to non-administrators by default. The fix rejects any backslash inside a double-quoted identifier, as was already done for single-quoted strings, because its meaning depends on a server setting that cannot be known reliably when the query is validated. Queries containing such identifiers are now refused.

CVE-2026-116243 (CVSS 7.7, HIGH) is a second route to command execution. The binary-path guard covered STORAGE_DIR but not SHARED_STORAGE, where ordinary users can upload files. A user could point their binary path at an uploaded executable and have pgAdmin run it. The record says this is exploitable where any file with an executable name can run, such as Windows server mode, because files created through pgAdmin on POSIX are not executable.

Connection strings and file paths that reached other users' data #

CVE-2026-116252 (CVSS 7.1, HIGH) affects the materialized view refresh, which passed the target database's name to psql's --dbname unchanged. libpq treats a value containing "=" or a postgresql:// URI as a full connection string, whose keywords override the host and port pgAdmin supplied. A database with such a name, which any role with CREATEDB can create, redirected the refresh to a host chosen by the creator, and the connecting user's saved server password was presented to that endpoint.

The record says the same weakness was fixed for Backup, Restore, Maintenance and Import/Export Data under CVE-2026-86862, and that the materialized view refresh was the remaining caller. The fix routes the name through database_conninfo(), so libpq treats it strictly as a database name.

CVE-2026-116249 (CVSS 7.2, HIGH) covers connection file paths set in the server dialog, the REST API or a servers.json import. get_complete_file_path() stripped only leading slashes before joining the path to the storage directory, so a path such as "../<another user>/.pgpass" named another user's file. Connecting then used that user's saved passwords, client certificate or SSH key.

The same record notes that the sslkeylogfile parameter was passed to libpq unchanged, so a path outside storage let libpq create or append a file as the service account, and that make_conninfo() quoted parameter values but not their names. The fix requires the resolved path, with symbolic links followed, to stay inside the user's storage directory or the named shared storage directory, and accepts only exact libpq keywords as parameter names.

Server sharing and File Manager path checks #

CVE-2026-116248 (CVSS 6, MEDIUM, assigned by PostgreSQL) concerns server sharing. The server dialog shows the Shared switch only to administrators, but the create and update endpoints stored the shared flag from any user able to register a server. A shared server carries no credentials, yet it lets a user place a server named to look trusted in every other user's tree, and anyone who connects to it presents their own database password to the host the user controls.

The fix refuses such a request from a non-administrator with HTTP 403, and prunes non-administrator shared entries from a servers.json import before validating it. The record also says 9.19 warns at startup about servers shared earlier by non-administrators. The announcement further lists CVE-2026-116240, which covers the File Manager and storage-path tools acting on a different path from the one that was checked, and CVE-2026-116250, which covers time-of-check to time-of-use symlink, hard-link and FIFO races in the File Manager, Import/Export Servers, Backup, Restore and Import/Export Data file paths.

Affected and fixed pgAdmin 4 versions #

The affected range is the same across the records: pgAdmin 4 before 9.19. The scope differs by mode, and the announcement gives the 9.19 downloads, which are listed in the table below.

Server-mode settings that 9.19 introduces #

Free-text Password Exec Commands in server mode are replaced by an administrator-defined allowlist, SERVER_PASSEXEC_COMMANDS. The announcement says the commands run without a shell and with a reduced environment, and it gives this instruction:

Configure SERVER_PASSEXEC_COMMANDS before the first start after upgrading.

SERVER_MODE_ALLOWED_SERVICES, added by the fix for CVE-2026-116245, is empty by default. In server mode only a listed service can be used, the servicefile parameter is refused, and PGPASSWORD and PGSERVICE are removed from pgAdmin's environment at startup. The allowlist is checked again on the final connection string, so a connection that depends on a service entry needs that service listed.

Protection steps for pgAdmin 4 server mode #

1. Upgrade to pgAdmin 4 9.19 using the packages listed in the announcement.
2. Before the first start after upgrading, configure SERVER_PASSEXEC_COMMANDS.
3. List every service that users need in SERVER_MODE_ALLOWED_SERVICES, which is empty by default.
4. Confirm that libpq on the pgAdmin host is version 16 or later, because the CVE-2026-116244 record states that require_auth needs libpq 16 or later.
5. Review servers shared by non-administrators, since 9.19 warns about them at startup under CVE-2026-116248.
6. Review Import/Export Data queries that contain a backslash inside a double-quoted identifier, because the CVE-2026-116241 fix rejects them.

Also in this release #

• Statistics node for creating and managing extended statistics; simple auto-updatable views for editing data in View/Edit Data, with generated columns handled properly.
• Query Tool results saved as JSON or XML as well as CSV, with selectable encoding, an optional byte order mark and "copy with headers"; files loaded as latin-1 or another non-UTF-8 encoding are no longer saved back as UTF-8.
• Management of pg_timetable chains and tasks; pgEdge Starfleet added to the Deploy Cloud Instance wizard.
• Login page can be skipped when OAuth2 is the only authentication source.
• Schema Diff fixes for SERIAL/BIGSERIAL conversions, renamed function arguments, repeated column comments, identity options and false differences caused by a dropped column in a referenced table.
• MAINTAIN privilege kept for views and materialised views on PostgreSQL 17 and later.
• Kerberos login failures no longer return a JSON 500 response, and first-time automatically created Kerberos logins are accepted.
• Linux packages no longer ship a stray copy of Python, which had stopped the DEB package installing on Ubuntu 26.04.

The announcement reports 136 bug fixes and new features in total and links to the release notes for the complete list.

Checking pgAdmin 4 installations for the affected settings #

Compare the installed pgAdmin 4 version with 9.19: the records state that pgAdmin 4 before 9.19 is affected, so installations below 9.19 need the protection steps above. To find the settings named in these records, search the configuration file that your installation reads for their names.

grep -nE 'MAX_LOGIN_ATTEMPTS|AUTHENTICATION_SOURCES|SHARED_STORAGE|SERVER_PASSEXEC_COMMANDS|SERVER_MODE_ALLOWED_SERVICES' <config-file>

If AUTHENTICATION_SOURCES lists internal authentication before LDAP or Kerberos, the account-selection behaviour in CVE-2026-116239 applies to that configuration. If SHARED_STORAGE is set, check each user's binary path preference against the SHARED_STORAGE directories, as CVE-2026-116243 describes. Desktop-only installations are not affected by CVE-2026-116238 or CVE-2026-116239, according to their records.