pgAdmin 4 fixes 15 CVEs in 9.19, including command execution through Import/Export (CVE-2026-116241) and a login lockout bypass ยท updates https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241 pgAdmin 4 9.19 (released Oct 29 2026) fixes a batch of CVEs published on Oct 30 2026, all affecting versions before 9.19. The worst, CVE-2026-116241 (CVSS 4.0 9.4, CVSS 3.1 9.9), bypasses the earlier fix for CVE-2026-17566: in the Import/Export Data tool a backslash inside a double-quoted identifier lets a query escape psql's \copy wrapper, so a TO PROGRAM clause runs on the pgAdmin host as the operating-system account running pgAdmin. An ordinary database role can trigger it, since it can turn standard_conforming_strings off for itself and the Import/Export permission is granted to non-administrators by default. CVE-2026-116238 (CVSS 4.0 9.2) lets an unauthenticated attacker in server mode bypass the failed-login lockout and guess passwords for any internal account, including the administrator's. Other fixes cover LDAP/Kerberos accounts colliding with same-named users (CVE-2026-116239), pgAdmin's own SSH, Kerberos, password-file and certificate credentials being used for user connections, storage-directory path escapes and symlink races, and sessions that survive a password change. No exploitation has been reported so far. en Fri, 30 Oct 2026 00:00:00 GMT pgAdmin 4 fixes 15 CVEs in 9.19, including command execution through Import/Export (CVE-2026-116241) and a login lockout bypass: pgAdmin publishes CVE-2026-116238 to CVE-2026-116252 for versions before 9.19, led by CVE-2026-116241 (command execution on the pgAdmin host through Import/Export, a bypass of the CVE-2026-17566 fix, CVSS 4.0 9.4) and CVE-2026-116238 (unauthenticated login lockout bypass, CVSS 4.0 9.2). https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241 https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241#2026-10-30-dd122039 Fri, 30 Oct 2026 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-116241">Source</a></p> pgAdmin 4 fixes 15 CVEs in 9.19, including command execution through Import/Export (CVE-2026-116241) and a login lockout bypass: pgAdmin 4 9.19 is released. https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241 https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241#2026-10-29-74844d05 Thu, 29 Oct 2026 00:00:00 GMT critical <p><a href="https://www.pgadmin.org/docs/pgadmin4/9.19/release_notes_9_19.html">Source</a></p> pgAdmin 4 fixes 15 CVEs in 9.19, including command execution through Import/Export (CVE-2026-116241) and a login lockout bypass: pgAdmin commits the fix for the Import/Export Data backslash bypass (issue #10663). https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241 https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241#2026-10-24-facedfbb Sat, 24 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/pgadmin-org/pgadmin4/commit/9be31a019f780647fb689c458408c8803263c812">Source</a></p>