pgAdmin 4 v9.19 Released

The pgAdmin Development Team is pleased to announce pgAdmin 4 version 9.19.

This release of pgAdmin 4 includes 136 bug fixes and new features, including fixes for 15 security vulnerabilities (CVE-2026-116238 through CVE-2026-116252). For more details please see the release notes. pgAdmin is the leading open-source graphical management tool for PostgreSQL.

For more information, please see the website. Notable changes in this release include: Features Add a Statistics node for creating and managing extended statistics. Allow data to be edited through simple auto-updatable views in View/Edit Data.

Save Query Tool results as JSON or XML as well as CSV, with a selectable encoding, an optional byte order mark, and a 'copy with headers' option. Add support for managing pg_timetable chains and tasks. Replace free-text Password Exec Commands in server mode with an administrator-defined allowlist, SERVER_PASSEXEC_COMMANDS; the commands run without a shell and with a reduced environment.

Configure SERVER_PASSEXEC_COMMANDS before the first start after upgrading. Add pgEdge Starfleet to the Deploy Cloud Instance wizard. Allow the login page to be skipped when OAuth2 is the only authentication source.

Security Fixes Fix OS command injection in the Import/Export Data tool, where a query-based export could smuggle a live TO PROGRAM clause past the \copy parenthesis guard through a backslash in a double-quoted identifier and run an arbitrary command on the pgAdmin host; an incomplete fix for CVE-2026-17566 (CVE-2026-116241).

Fix LDAP and Kerberos authentication logging a user in to a different account that shared their username, including the initial administrator (CVE-2026-116239). Fix bypasses of the failed-login limit and of pgAdmin's own login, password-change and password-reset checks, through Flask-Security's own views and through username case and second-source handling (CVE-2026-116238).

Fix connection file paths and parameter keys escaping the user's storage directory, which let a user connect with another user's credentials or key (CVE-2026-116249). Stop libpq falling back to the pgAdmin service account's own password file and client certificate in server mode (CVE-2026-116247).

Restrict connection services in server mode to an administrator-defined allowlist, SERVER_MODE_ALLOWED_SERVICES (CVE-2026-116245). Stop libpq using the pgAdmin service account's Kerberos credentials in server mode (CVE-2026-116244). Stop SSH tunnels using the pgAdmin service account's own SSH identity in server mode (CVE-2026-116242).

Fix the utility binary-path guard accepting a path under SHARED_STORAGE, which let a user have pgAdmin execute a file they placed there (CVE-2026-116243). Stop server passwords being left in pgAdmin's own process environment, where another user's session or utility could inherit them (CVE-2026-116246).

Fix any user able to register a server being able to share it with every other user in server mode (CVE-2026-116248). Fix the File Manager and the storage-path tools acting on a different path from the one that was checked (CVE-2026-116240).

Fix time-of-check to time-of-use symlink, hard-link and FIFO races in the File Manager, Import/Export Servers, Backup, Restore and Import/Export Data file paths (CVE-2026-116250). Fix a user's other sessions surviving a password change or administrator reset (CVE-2026-116251).

Fix connection redirection in the materialized view refresh, where a crafted database name was expanded by libpq into a full connection string (CVE-2026-116252). Bugs/Housekeeping Fix numerous Schema Diff issues, including SERIAL/BIGSERIAL conversions, renamed function arguments, repeated column comments and identity options, and false differences caused by a dropped column in a referenced table.

Fix View/Edit Data not handling generated columns properly. Fix the MAINTAIN privilege being silently dropped for views and materialised views on PostgreSQL 17 and later. Fix Kerberos login failures returning a JSON 500 response, and first-time automatically created Kerberos logins being rejected.

Fix the Query Tool saving files that were loaded as latin-1 or another non-UTF-8 encoding back as UTF-8. Fix the Linux packages shipping a stray copy of Python, which stopped the DEB package installing on Ubuntu 26.04. Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the download area.