Shkarko pgAdmin 4 9.19

The pgAdmin Development Team is pleased to announce pgAdmin 4 version 9.19. This release of pgAdmin 4 includes 136 bug fixes and new features, including fixes for 15 security vulnerabilities (CVE-2026-116238 through CVE-2026-116252). For more details please see the release notes.
pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website.
Notable changes in this release include:
Features:
- Add a Statistics node for creating and managing extended statistics.
- Allow data to be edited through simple auto-updatable views in View/Edit Data.
- Save Query Tool results as JSON or XML as well as CSV, with a selectable encoding, an optional byte order mark, and a 'copy with headers' option.
- Add support for managing pg_timetable chains and tasks.
- Replace free-text Password Exec Commands in server mode with an administrator-defined allowlist, SERVER_PASSEXEC_COMMANDS; the commands run without a shell and with a reduced environment. Configure SERVER_PASSEXEC_COMMANDS before the first start after upgrading.
- Add pgEdge Starfleet to the Deploy Cloud Instance wizard, and allow the login page to be skipped when OAuth2 is the only authentication source.
Security Fixes:
- Fix OS command injection in the Import/Export Data tool, where a query-based export could smuggle a live TO PROGRAM clause past the \copy parenthesis guard through a backslash in a double-quoted identifier and run an arbitrary command on the pgAdmin host; an incomplete fix for CVE-2026-17566 (CVE-2026-116241).
- Fix LDAP and Kerberos authentication logging a user in to a different account that shared their username, including the initial administrator (CVE-2026-116239).
- Fix bypasses of the failed-login limit and of pgAdmin's own login, password-change and password-reset checks, through Flask-Security's own views and through username case and second-source handling (CVE-2026-116238).
- Fix connection file paths and parameter keys escaping the user's storage directory, which let a user connect with another user's credentials or key (CVE-2026-116249).
- Stop libpq falling back to the pgAdmin service account's own password file and client certificate in server mode (CVE-2026-116247).
- Restrict connection services in server mode to an administrator-defined allowlist, SERVER_MODE_ALLOWED_SERVICES (CVE-2026-116245).
- Stop libpq using the pgAdmin service account's Kerberos credentials in server mode (CVE-2026-116244).
- Stop SSH tunnels using the pgAdmin service account's own SSH identity in server mode (CVE-2026-116242).
- Fix the utility binary-path guard accepting a path under SHARED_STORAGE, which let a user have pgAdmin execute a file they placed there (CVE-2026-116243).
- Stop server passwords being left in pgAdmin's own process environment, where another user's session or utility could inherit them (CVE-2026-116246).
- Fix any user able to register a server being able to share it with every other user in server mode (CVE-2026-116248).
- Fix the File Manager and the storage-path tools acting on a different path from the one that was checked (CVE-2026-116240).
- Fix time-of-check to time-of-use symlink, hard-link and FIFO races in the File Manager, Import/Export Servers, Backup, Restore and Import/Export Data file paths (CVE-2026-116250).
- Fix a user's other sessions surviving a password change or administrator reset (CVE-2026-116251).
- Fix connection redirection in the materialized view refresh, where a crafted database name was expanded by libpq into a full connection string (CVE-2026-116252).
Bugs/Housekeeping:
- Fix numerous Schema Diff issues, including SERIAL/BIGSERIAL conversions, renamed function arguments, repeated column comments and identity options, and false differences caused by a dropped column in a referenced table.
- Fix View/Edit Data not handling generated columns properly.
- Fix the MAINTAIN privilege being silently dropped for views and materialised views on PostgreSQL 17 and later.
- Fix Kerberos login failures returning a JSON 500 response, and first-time automatically created Kerberos logins being rejected.
- Fix the Query Tool saving files that were loaded as latin-1 or another non-UTF-8 encoding back as UTF-8.
- Fix the Linux packages shipping a stray copy of Python, which stopped the DEB package installing on Ubuntu 26.04.
Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the download area.