pgAdmin 4 9.19 patches 15 CVEs, adds extended statistics and pg_timetable support

The pgAdmin Development Team has released pgAdmin 4 version 9.19, the open-source graphical management tool for PostgreSQL, containing 136 bug fixes and new features alongside fixes for 15 security vulnerabilities tracked as CVE-2026-116238 through CVE-2026-116252. This release addresses critical security flaws in server deployments including OS command injection via the Import/Export Data tool, LDAP and Kerberos authentication bypasses that could log users into different accounts, and multiple server-mode privilege escalation vectors where users could access other users' credentials or execute arbitrary commands.

New capabilities include a Statistics node for creating and managing PostgreSQL extended statistics, the ability to edit data through simple auto-updatable views, expanded Query Tool export formats to JSON and XML with encoding options, and integration with pg_timetable for managing job scheduling chains and tasks. The release also hardens server-mode deployments with administrator-defined allowlists for password execution commands and connection services, replaces shell-based command execution with reduced-environment execution, and resolves numerous Schema Diff accuracy issues and PostgreSQL 17 compatibility problems.

Security hardening and new database management features

• OS command injection fix: The Import/Export Data tool's \copy parenthesis guard was bypassed through backslash-escaped double-quoted identifiers allowing TO PROGRAM clause injection; the fix addresses an incomplete prior patch for CVE-2026-17566 (CVE-2026-116241).
• Authentication isolation: LDAP and Kerberos fixes prevent username collisions from logging users into different accounts, including the initial administrator account, and close bypasses of failed-login limits through Flask-Security views and case-handling inconsistencies (CVE-2026-116238, CVE-2026-116239).
• Server-mode privilege containment: Multiple CVEs resolve server-mode vulnerabilities including libpq falling back to the service account's password file and client certificates, SSH tunnels using the service account's SSH identity, and connection file paths escaping user storage directories (CVE-2026-116242 through CVE-2026-116249).
• Extended statistics and pg_timetable integration: New features add a Statistics node for PostgreSQL's extended statistics framework and native management of pg_timetable job scheduling chains and tasks within the pgAdmin interface.
• Export and deployment enhancements: Query Tool results can now be saved as JSON or XML with selectable encoding, optional BOM, and header inclusion; pgEdge Starfleet cloud deployment is added to the Deploy Cloud Instance wizard.

Why it matters

For PostgreSQL administrators running pgAdmin in multi-user server mode, this release is essential due to the breadth of privilege escalation and credential isolation vulnerabilities that could allow cross-user access or host-level command execution. The addition of pg_timetable management and extended statistics support strengthens pgAdmin's position as a comprehensive PostgreSQL operations platform, while the Schema Diff and PostgreSQL 17 MAINTAIN privilege fixes improve reliability for database migration workflows.