pgAdmin 4 fixes 15 CVEs in 9.19, including command execution through Import/Export (CVE-2026-116241) and a login lockout bypass

pgAdmin 4 9.19 (released Oct 29 2026) fixes a batch of CVEs published on Oct 30 2026, all affecting versions before 9.19. The worst, CVE-2026-116241 (CVSS 4.0 9.4, CVSS 3.1 9.9), bypasses the earlier fix for CVE-2026-17566: in the Import/Export Data tool a backslash inside a double-quoted identifier lets a query escape psql's \copy wrapper, so a TO PROGRAM clause runs on the pgAdmin host as the operating-system account running pgAdmin. An ordinary database role can trigger it, since it can turn standard_conforming_strings off for itself and the Import/Export permission is granted to non-administrators by default. CVE-2026-116238 (CVSS 4.0 9.2) lets an unauthenticated attacker in server mode bypass the failed-login lockout and guess passwords for any internal account, including the administrator's. Other fixes cover LDAP/Kerberos accounts colliding with same-named users (CVE-2026-116239), pgAdmin's own SSH, Kerberos, password-file and certificate credentials being used for user connections, storage-directory path escapes and symlink races, and sessions that survive a password change. No exploitation has been reported so far.

Why this severity: CVE-2026-116241 is CVSS 4.0 9.4 / CVSS 3.1 9.9 (pgAdmin CNA): any database role with the default Import/Export permission can run commands on the pgAdmin host. CVE-2026-116238 is CVSS 4.0 9.2 and needs no login. No exploitation reported yet.

Started

Oct 30, 2026

CVEs

CVE-2026-116241CVE-2026-116238CVE-2026-116239CVE-2026-116240CVE-2026-116242CVE-2026-116243CVE-2026-116244CVE-2026-116245CVE-2026-116246CVE-2026-116247CVE-2026-116248CVE-2026-116249CVE-2026-116250CVE-2026-116251CVE-2026-116252

• #Pgadmin
• #Postgres
• #Command injection
• RCE
• Auth bypass
• #Path Traversal
• #Patch Bypass