A recent security update remediates fifteen critical flaws in pgAdmin 4, exposing database management platforms to remote code execution, authentication bypasses, and credential theft. These vulnerabilities impact deployment servers and desktop environments globally, creating significant risks for underlying enterprise infrastructure. While active exploitation has not been confirmed in the wild, the severity of the flaws demands immediate operational awareness. Administrators must prioritize patching across all affected server and desktop instances to eliminate potential attack vectors. The highest severity rating reaches 9.9 on the CVSSv3 scale, highlighting the pressing nature of these security updates.
CVE-2026-116241:This critical vulnerability affects the Import and Export Data tool, where query exports run commands through backslashes in double-quoted identifiers. The parser fails to restrict backslashes, allowing attackers to turn off standard conforming strings and escape query wrappers. The resulting impact enables execution of arbitrary operating system commands on the pgAdmin host system. Exploitation risks remain high for database environments operating in server mode without proper input validation controls.[/subscribe_to_unlock_form]
A recent security update remediates fifteen critical flaws in pgAdmin 4, exposing database management platforms to remote code execution, authentication bypasses, and credential theft. These vulnerabilities impact deployment servers and desktop environments globally, creating significant risks for underlying enterprise infrastructure. While active exploitation has not been confirmed in the wild, the severity of the flaws demands immediate operational awareness. Administrators must prioritize patching across all affected server and desktop instances to eliminate potential attack vectors. The highest severity rating reaches 9.9 on the CVSSv3 scale, highlighting the pressing nature of these security updates.
CVE-2026-116241:This critical vulnerability affects the Import and Export Data tool, where query exports run commands through backslashes in double-quoted identifiers. The parser fails to restrict backslashes, allowing attackers to turn off standard conforming strings and escape query wrappers. The resulting impact enables execution of arbitrary operating system commands on the pgAdmin host system. Exploitation risks remain high for database environments operating in server mode without proper input validation controls.[emaillocker id="1283"]
CVE-2026-116239:This high-severity flaw involves LDAP or Kerberos login mechanisms logging users into alternate accounts sharing identical usernames. The affected component validates identity based solely on the username field rather than fully qualified account paths. The impact allows unauthorized users to collide with internal administrator profiles during authentication sessions. Exploitation risks involve unauthorized administrative access within enterprise server deployments.
CVE-2026-116249:This vulnerability occurs when connection file paths and parameter keys escape the designated user storage directory. The underlying component fails to enforce proper directory boundary validation checks during file operations. The resulting impact permits unauthorized file access across isolated user directories on the host operating system. Exploitation risks involve directory traversal and unauthorized exposure of sensitive local files.
CVE-2026-116242:This high-severity issue involves SSH tunnels using the pgAdmin service account's own SSH identity keys. The affected component improperly inherits service-level credentials for outbound tunnel connections. The impact permits unintended access leveraging high-privileged service credentials. Exploitation risks involve unauthorized lateral movement or resource access if an attacker gains control over a session.
CVE-2026-116244:This flaw causes libpq to utilize the pgAdmin service account's existing Kerberos credentials during connection operations. The affected component lacks proper credential isolation between distinct user sessions. The impact allows user-initiated database actions to inherit high-level Kerberos tokens. Exploitation risks center on unintended privilege inheritance within enterprise Active Directory environments.
CVE-2026-116245:This vulnerability involves connection services that remain unrestricted when the application operates in server mode. The affected configuration component fails to enforce boundaries on service file lookups. The impact permits external service definitions to influence database connection parameters. Exploitation risks include redirection and unauthorized credential exposure.
CVE-2026-116247:This issue causes libpq to default to using the pgAdmin service account's own password file and client certificate. The affected component fails to isolate local authentication artifacts across user boundaries. The impact exposes administrative credentials to local session inspection. Exploitation risks involve unauthorized credential harvesting on multi-user server hosts.
CVE-2026-116238:This high-severity flaw allows the failed login limit to be bypassed entirely while Flask-Security views skip proper checks. The affected authentication component fails to count incorrect password attempts against brute-force restrictions. The impact enables continuous automated guessing attacks against administrator accounts. Exploitation risks involve unauthorized privilege acquisition through credential brute-forcing.
Immediate patching and strict network perimeter controls represent the primary defense against these vulnerabilities. Organizations must upgrade all server and desktop deployments to version 9.19 immediately. If patching is delayed, administrators should restrict network access to the web interface and disable shared storage directories.
We recommend you to update pgAdmin to version 9.19.
The following reports contain further technical details:
[/emaillocker]