pgAdmin 4 update fixes 15 flaws, including command execution

The pgAdmin development team released version 9.19 on 29 October 2026, fixing 15 vulnerabilities in earlier versions: two rated critical, 11 high and two medium. The flaws affect pgAdmin deployments, particularly those running in server mode on Linux and Windows, and could expose database credentials, user files and the host system. The supplied account says no exploitation in the wild has been confirmed and no public proof-of-concept code has been published.

Among the issues, CVE-2026-116241 allows command execution through the Import and Export Data tool: a backslash in a double-quoted identifier can escape the query wrapper and run operating-system commands on the pgAdmin host. CVE-2026-116239 can log an LDAP or Kerberos user into an internal account with the same username. CVE-2026-116238 lets attackers bypass failed-login limits, while other flaws can expose credentials or allow access to files outside a user’s storage directory.

All 15 vulnerabilities are fixed in pgAdmin 4 version 9.19. The development team’s guidance, as reported by SecurityOnline, is to upgrade; where that is not immediately possible, administrators are advised to restrict access to the web interface, disable shared storage directories and apply perimeter network controls.