pgAdmin 4 9.19 Fixes 15 Security Vulnerabilities
Tech GuruQuick Answer
pgAdmin 4 9.19 fixes 15 security vulnerabilities, including critical query-export command injection. Inventory deployments, upgrade, configure the new password-command allowlist, review shared servers and inherited credentials, test database tooling and authentication, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory pgAdmin desktop and server-mode deployments, exact versions, users and shared servers, authentication sources, storage paths, SSH and Kerberos settings, utilities, owners, and backups. Match each CVE to its documented mode and prerequisite; do not assume every pgAdmin installation exposes every server-mode, POSIX, authentication, or storage-path issue. Upgrade to pgAdmin 4 9.19, configure SERVER_PASSEXEC_COMMANDS before first start where used, and complete the release-note review of shared servers and connection credentials. Confirm the running version, test login, MFA, shared servers, SSH, Kerberos, backup, restore, import/export and file operations, review legacy sharing and credentials, and retain evidence.
Last verified: 2026-10-31 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | pgAdmin 4, especially multi-user server-mode deployments |
|---|---|
| Advisory | pgAdmin 4 9.19 security fixes |
| CVEs | CVE-2026-116238, CVE-2026-116239, CVE-2026-116240, CVE-2026-116241, CVE-2026-116242, CVE-2026-116243, CVE-2026-116244, CVE-2026-116245, CVE-2026-116246, CVE-2026-116247, CVE-2026-116248, CVE-2026-116249, CVE-2026-116250, CVE-2026-116251, CVE-2026-116252 |
| Authoritative release date | 2026-10-29 00:00:00 UTC |
| Authority revision date | 2026-10-30 19:55:20.208 UTC |
| Affected versions | pgAdmin 4 versions before 9.19; several issues are specific to server mode, POSIX hosts, authentication methods, shared servers, storage paths, utilities, or query export. |
| Fixed version | pgAdmin 4 version 9.19, with the documented post-upgrade configuration and review actions |
| CVSS base score | 2.3-9.9 (CVSS v3.1/v4.0; CVE-specific) |
| CVSS severity | Low to Critical |
| Exploitation status | The pgAdmin project does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
pgAdmin 4 9.19 fixes 15 CVEs spanning command injection, authentication and authorization, credential inheritance, path containment, session invalidation, and server-mode isolation.
What To Validate Now
- Inventory. Inventory pgAdmin desktop and server-mode deployments, exact versions, users and shared servers, authentication sources, storage paths, SSH and Kerberos settings, utilities, owners, and backups.
- Establish applicability. Match each CVE to its documented mode and prerequisite; do not assume every pgAdmin installation exposes every server-mode, POSIX, authentication, or storage-path issue.
- Remediate. Upgrade to pgAdmin 4 9.19, configure SERVER_PASSEXEC_COMMANDS before first start where used, and complete the release-note review of shared servers and connection credentials.
- Validate. Confirm the running version, test login, MFA, shared servers, SSH, Kerberos, backup, restore, import/export and file operations, review legacy sharing and credentials, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The upgrade changes password-command handling and credential inheritance; some restrictions are not retroactive or differ by platform, so stage and review the release notes closely.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
