# pgAdmin 4 fixes 15 CVEs in 9.19, including command execution through Import/Export (CVE-2026-116241) and a login lockout bypass · pwn.watch

> pgAdmin 4 9.19 (released Oct 29 2026) fixes a batch of CVEs published on Oct 30 2026, all affecting versions before 9.19. The worst, CVE-2026-116241 (CVSS 4.0 9.4, CVSS 3.1 9.9), bypasses the earlier fix for CVE-2026-17566: in the Import/Export Data tool a backslash inside a double-quoted identifier lets a query escape psql's \copy wrapper, so a TO PROGRAM clause runs on the pgAdmin host as the operating-system account running pgAdmin. An ordinary database role can trigger it, since it can turn standard_conforming_strings off for itself and the Import/Export permission is granted to non-administrators by default. CVE-2026-116238 (CVSS 4.0 9.2) lets an unauthenticated attacker in server mode bypass the failed-login lockout and guess passwords for any internal account, including the administrator's. Other fixes cover LDAP/Kerberos accounts colliding with same-named users (CVE-2026-116239), pgAdmin's own SSH, Kerberos, password-file and certificate credentials being used for user connections, storage-directory path escapes and symlink races, and sessions that survive a password change. No exploitation has been reported so far.

Page: https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241 · generated 2026-10-30T22:43:41.445Z

## Status
- Severity: critical · status: live · patch: patched
- Product: pgAdmin 4
- Started: 2026-10-30
- CVEs: CVE-2026-116241, CVE-2026-116238, CVE-2026-116239, CVE-2026-116240, CVE-2026-116242, CVE-2026-116243, CVE-2026-116244, CVE-2026-116245, CVE-2026-116246, CVE-2026-116247, CVE-2026-116248, CVE-2026-116249, CVE-2026-116250, CVE-2026-116251, CVE-2026-116252
- Affected: pgAdmin 4 before 9.19
- Fixed in: pgAdmin 4 9.19

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241/feed.xml
- JSON Feed: https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241.json
- This file: https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241/llms.txt

## Updates (newest first)
- 2026-10-30: pgAdmin publishes CVE-2026-116238 to CVE-2026-116252 for versions before 9.19, led by CVE-2026-116241 (command execution on the pgAdmin host through Import/Export, a bypass of the CVE-2026-17566 fix, CVSS 4.0 9.4) and CVE-2026-116238 (unauthenticated login lockout bypass, CVSS 4.0 9.2). (https://nvd.nist.gov/vuln/detail/CVE-2026-116241)
- 2026-10-29: pgAdmin 4 9.19 is released. (https://www.pgadmin.org/docs/pgadmin4/9.19/release_notes_9_19.html)
- 2026-10-24: pgAdmin commits the fix for the Import/Export Data backslash bypass (issue #10663). (https://github.com/pgadmin-org/pgadmin4/commit/9be31a019f780647fb689c458408c8803263c812)

## Fix brief
# Security brief: pgAdmin 4 fixes 15 CVEs in 9.19, including command execution through Import/Export (CVE-2026-116241) and a login lockout bypass

Source: https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241 · status: live · severity: critical · updated Oct 30, 2026, 20:41 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
pgAdmin 4 9.19 (released Oct 29 2026) fixes a batch of CVEs published on Oct 30 2026, all affecting versions before 9.19. The worst, CVE-2026-116241 (CVSS 4.0 9.4, CVSS 3.1 9.9), bypasses the earlier fix for CVE-2026-17566: in the Import/Export Data tool a backslash inside a double-quoted identifier lets a query escape psql's \copy wrapper, so a TO PROGRAM clause runs on the pgAdmin host as the operating-system account running pgAdmin. An ordinary database role can trigger it, since it can turn standard_conforming_strings off for itself and the Import/Export permission is granted to non-administrators by default. CVE-2026-116238 (CVSS 4.0 9.2) lets an unauthenticated attacker in server mode bypass the failed-login lockout and guess passwords for any internal account, including the administrator's. Other fixes cover LDAP/Kerberos accounts colliding with same-named users (CVE-2026-116239), pgAdmin's own SSH, Kerberos, password-file and certificate credentials being used for user connections, storage-directory path escapes and symlink races, and sessions that survive a password change. No exploitation has been reported so far.

Severity detail: CVE-2026-116241 is CVSS 4.0 9.4 / CVSS 3.1 9.9 (pgAdmin CNA): any database role with the default Import/Export permission can run commands on the pgAdmin host. CVE-2026-116238 is CVSS 4.0 9.2 and needs no login. No exploitation reported yet.

- Product: pgAdmin 4
- CVE / advisory ids: CVE-2026-116241, CVE-2026-116238, CVE-2026-116239, CVE-2026-116240, CVE-2026-116242, CVE-2026-116243, CVE-2026-116244, CVE-2026-116245, CVE-2026-116246, CVE-2026-116247, CVE-2026-116248, CVE-2026-116249, CVE-2026-116250, CVE-2026-116251, CVE-2026-116252

## Affected versions
- pgAdmin 4 before 9.19

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- pgAdmin 4 9.19

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
Upgrade pgAdmin 4 to 9.19 or later (desktop, server mode, container image and Python package). Server-mode deployments shared with several users are most exposed. Until upgraded, limit who can reach pgAdmin's login page and remove the Import/Export Data permission from non-administrator roles. Re-check NVD and news for a public PoC or exploitation.

## Latest updates
- Oct 30, 2026: pgAdmin publishes CVE-2026-116238 to CVE-2026-116252 for versions before 9.19, led by CVE-2026-116241 (command execution on the pgAdmin host through Import/Export, a bypass of the CVE-2026-17566 fix, CVSS 4.0 9.4) and CVE-2026-116238 (unauthenticated login lockout bypass, CVSS 4.0 9.2).
- Oct 29, 2026: pgAdmin 4 9.19 is released.
- Oct 24, 2026: pgAdmin commits the fix for the Import/Export Data backslash bypass (issue #10663).

## Advisories
- [CVE-2026-116241: Import/Export Data query export runs a command through a backslash in a double-quoted identifier](https://nvd.nist.gov/vuln/detail/CVE-2026-116241) (NVD (pgAdmin CNA))
- [CVE-2026-116238: The failed login limit can be bypassed](https://nvd.nist.gov/vuln/detail/CVE-2026-116238) (NVD (pgAdmin CNA))
- [CVE-2026-116239: An LDAP or Kerberos login is logged in to another account with the same username](https://nvd.nist.gov/vuln/detail/CVE-2026-116239) (NVD (pgAdmin CNA))
- [pgAdmin 4 Version 9.19 release notes](https://www.pgadmin.org/docs/pgadmin4/9.19/release_notes_9_19.html) (pgAdmin)

## Write-ups & news
- [Reject a backslash in a double-quoted identifier in the Import/Export Data query export (#10663)](https://github.com/pgadmin-org/pgadmin4/commit/9be31a019f780647fb689c458408c8803263c812)

---
Machine-readable: https://pwn.watch/i/pgadmin-4-9-19-import-export-rce-login-bypass-cve-2026-116241.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.