pgAdmin 4 v9.19 Released

The pgAdmin Development Team is pleased to announce pgAdmin 4 version 9.19. This release of pgAdmin 4 includes 136 bug fixes and new features, including fixes for 15 security vulnerabilities (CVE-2026-116238 through CVE-2026-116252). For more details please see the release notes.

pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website.

Notable changes in this release include:

Features

• Add a Statistics node for creating and managing extended statistics.
• Allow data to be edited through simple auto-updatable views in View/Edit Data.
• Save Query Tool results as JSON or XML as well as CSV, with a selectable encoding, an optional byte order mark, and a 'copy with headers' option.
• Add support for managing pg_timetable chains and tasks.
• Replace free-text Password Exec Commands in server mode with an administrator-defined allowlist, SERVER_PASSEXEC_COMMANDS; the commands run without a shell and with a reduced environment. Configure SERVER_PASSEXEC_COMMANDS before the first start after upgrading.
• Add pgEdge Starfleet to the Deploy Cloud Instance wizard.
• Allow the login page to be skipped when OAuth2 is the only authentication source.

Security Fixes

• Fix OS command injection in the Import/Export Data tool, where a query-based export could smuggle a live TO PROGRAM clause past the \copy parenthesis guard through a backslash in a double-quoted identifier and run an arbitrary command on the pgAdmin host; an incomplete fix for CVE-2026-17566 (CVE-2026-116241).
• Fix LDAP and Kerberos authentication logging a user in to a different account that shared their username, including the initial administrator (CVE-2026-116239).
• Fix bypasses of the failed-login limit and of pgAdmin's own login, password-change and password-reset checks, through Flask-Security's own views and through username case and second-source handling (CVE-2026-116238).
• Fix connection file paths and parameter keys escaping the user's storage directory, which let a user connect with another user's credentials or key (CVE-2026-116249).
• Stop libpq falling back to the pgAdmin service account's own password file and client certificate in server mode (CVE-2026-116247).
• Restrict connection services in server mode to an administrator-defined allowlist, SERVER_MODE_ALLOWED_SERVICES (CVE-2026-116245).
• Stop libpq using the pgAdmin service account's Kerberos credentials in server mode (CVE-2026-116244).
• Stop SSH tunnels using the pgAdmin service account's own SSH identity in server mode (CVE-2026-116242).
• Fix the utility binary-path guard accepting a path under SHARED_STORAGE, which let a user have pgAdmin execute a file they placed there (CVE-2026-116243).
• Stop server passwords being left in pgAdmin's own process environment, where another user's session or utility could inherit them (CVE-2026-116246).
• Fix any user able to register a server being able to share it with every other user in server mode (CVE-2026-116248).
• Fix the File Manager and the storage-path tools acting on a different path from the one that was checked (CVE-2026-116240).
• Fix time-of-check to time-of-use symlink, hard-link and FIFO races in the File Manager, Import/Export Servers, Backup, Restore and Import/Export Data file paths (CVE-2026-116250).
• Fix a user's other sessions surviving a password change or administrator reset (CVE-2026-116251).
• Fix connection redirection in the materialized view refresh, where a crafted database name was expanded by libpq into a full connection string (CVE-2026-116252).

Bugs/Housekeeping

• Fix numerous Schema Diff issues, including SERIAL/BIGSERIAL conversions, renamed function arguments, repeated column comments and identity options, and false differences caused by a dropped column in a referenced table.
• Fix View/Edit Data not handling generated columns properly.
• Fix the MAINTAIN privilege being silently dropped for views and materialised views on PostgreSQL 17 and later.
• Fix Kerberos login failures returning a JSON 500 response, and first-time automatically created Kerberos logins being rejected.
• Fix the Query Tool saving files that were loaded as latin-1 or another non-UTF-8 encoding back as UTF-8.
• Fix the Linux packages shipping a stray copy of Python, which stopped the DEB package installing on Ubuntu 26.04.

Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the download area.