The PostgreSQL management tool

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.18. This release of pgAdmin 4 includes 29 bug fixes and new features, including fixes for four security vulnerabilities (CVE-2026-86861 through CVE-2026-86864). For more details, please see the release notes.

pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website.

Notable changes in this release include:

Features:

• Collapse and restore the Object Explorer by re-clicking the current workspace icon, in the manner of the VS Code side bar, remembering the choice across refreshes. A keyboard shortcut, Ctrl+Alt+B by default, does the same thing and can be changed through the new toggle_object_explorer preference.
• Harden the default Content-Security-Policy so inline scripts run under a per-request nonce rather than a blanket 'unsafe-inline', and drop 'unsafe-eval'. style-src keeps 'unsafe-inline', because MUI and React inject runtime styles and inline style attributes that cannot carry a nonce, and development bundles have 'unsafe-eval' re-added automatically when DEBUG is set.

Security Fixes:

• Fix an authentication bypass in Webserver authentication mode, where get_user() fell back to reading the configured WEBSERVER_REMOTE_USER name from the inbound request headers when it was absent from the WSGI environment. Because a header is written by whoever sends the request, any client that could reach pgAdmin could assert any identity, including an administrator's, without presenting a credential. A header-asserted identity is now opt-in, restricted to a configured list of trusted proxies with an optional shared secret, and refused for accounts whose authentication source is not webserver (CVE-2026-86863).
• Fix argument and connection-string injection in the Backup tool, where the client-supplied database name was appended to the pg_dump argument vector as a bare positional value. Because getopt_long permutes arguments, a value beginning with a dash supplied further options such as --file, overriding the storage-confined output path; and because libpq expands a database name containing an equals sign into a full connection string, the same field could redirect the connection, and the password exported in PGPASSWORD, to a host of the caller's choosing. The database name is now passed through the PGDATABASE environment variable, which libpq never expands (CVE-2026-86864).
• Fix connection-string injection in the Restore and Maintenance tools, where the client-supplied database name was passed straight to --dbname and could likewise redirect the connection, and the exported password, to a server of the caller's choosing (CVE-2026-86862).
• Fix a time-of-check to time-of-use flaw in the File Manager's save_file endpoint, which backs saving from the Query Tool and ERD: the requested path was validated with check_access_permission() and then opened with a plain open(), so a symbolic link planted in between was followed, writing outside the user's storage directory. This is the write sink that CVE-2026-7819's hardening of the separate upload path did not cover (CVE-2026-86861).
• Refuse HTTP redirects on LLM API requests, rather than following a Location header on to a destination the ALLOWED_LLM_API_URLS check was never applied to. This is hardening rather than a fix for an exploitable flaw, since returning the redirect at all requires control of a host already on the allowlist.
• Reject an empty or null Username when importing a non-shared server, which previously imported cleanly and left a server that libpq would silently authenticate as the OS account running pgAdmin rather than reject outright.

Bugs/Housekeeping:

• Fix login being impossible against Flask-Security-Too 5.8.2, which corrected a long-standing inversion in UserMixin.is_locked() that pgAdmin's own is_locked() had been written against.
• Fix inherited columns in the Table dialog being editable and deletable, and the Data type dropdown on the expanded Definition tab offering every type rather than honouring the allowed-type restriction applied inline.
• Reinstate dependency ordering of the script Schema Diff generates, which had been lost since the React port left dependLevel unset.
• Fix Schema Diff reporting false differences for SERIAL and BIGSERIAL columns, duplicating any column that also differs when recreating a foreign table, losing a foreign table column's collation, injecting whitespace into an applied function or procedure body, generating SQL that PostgreSQL rejects when a sequence's MINVALUE is raised above its current value, and reporting a comparison that fails part way through as a success.
• Share concurrent identical GET requests behind getNodeAjaxOptions() so a wide table's Columns tab no longer fires one duplicate get_types request per column row.
• Fix the argument grid on the Definition tab of a user-defined function or procedure refusing to delete, or add, a row in edit mode.
• Omit the redundant TABLESPACE pg_default clause from generated index SQL, which was invalid on a partitioned table.
• Fix a crash when a per-server Password Exec Command is used with a service-only (pg_service.conf) connection, which leaves host, port and username unset.
• Accept SharedUsername when importing a shared server from a servers.json definition, instead of insisting on Username for every server.
• Render the Validate binary path dialog as HTML, instead of showing the raw markup.
• Remove a trailing quote from the Windows installer's ProductVersion, and fix the existingSecret path in the Helm deployment template.
• Skip importing and initialising the Kerberos, LDAP, MFA, OAuth2 and Webserver authentication providers unless SERVER_MODE is set, leaving desktop mode with internal authentication alone.
• Bump JavaScript and Python third-party dependencies, and update the message catalogs, including a fix for the Korean catalog that had not been recompiled since November 2025.

Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the download area.

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.17. This release of pgAdmin 4 includes 28 bug fixes and new features, including fixes for seven security vulnerabilities (CVE-2026-17346 through CVE-2026-17351, and CVE-2026-17566). For more details, please see the release notes.

pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website.

Notable changes in this release include:

Features:

• Include the authenticated user's identity in the HTTP access log.
• Add an opt-in Gateway API HTTPRoute template to the Helm chart as an alternative to the existing Ingress.
• Add a preference to cap the row count fetched by the plain "View Data" action, so it is usable on large tables without always doing a full SELECT *.
• Add support for a custom XYZ tile provider (URL, name, CRS, attribution, max zoom) in the Geometry Viewer, alongside the existing built-in base layers.

Security Fixes:

• Fix a tool-permission bypass where a user denied the Query Tool, Grant Wizard, or Schema Diff permission could still drive that tool's backend routes and Socket.IO handlers directly, since the permission check was applied only to a single "front door" route per tool. Also fixes a non-owner triggering an adhoc connection against another user's shared server persisting a new server record still owned by that other user (CVE-2026-17350).
• Fix OS command injection in the MASTER_PASSWORD_HOOK feature, where an externally-sourced username (e.g. via OAuth2/OIDC, Kerberos, or webserver authentication) containing shell metacharacters could execute arbitrary commands as the pgAdmin service account when the configured hook string uses %u (CVE-2026-17347).
• Fix a lexer-differential bypass of the AI Assistant's read-only transaction guard, where sqlparse's string-literal lexing disagreed with PostgreSQL's own parser under standard_conforming_strings = on, letting a crafted multi-statement payload smuggle a COMMIT past the intended read-only wrapper; an incomplete fix for CVE-2026-12045 (CVE-2026-17351).
• Fix SQL injection in the Index Statistics all-indexes listing and the Publications/Subscriptions Dependencies views, where an apostrophe in a table, index, publication, or subscription name broke out of an unescaped template interpolation; an incomplete fix for CVE-2026-12044 (CVE-2026-17346).
• Fix several Constraints, Preferences, Debugger, and Schema Diff routes missing the @pga_login_required decorator, making them reachable without authentication in server mode; an incomplete fix for CVE-2026-12046 (CVE-2026-17348).
• Fix an adhoc server connection cloning another user's stored database credentials (password, save password flag, tunnel password) alongside ownership, letting a non-owner who cloned another user's shared server connect using that user's saved database password (CVE-2026-17349).
• Fix OS command injection in the Import/Export Data tool, where a query-based export could pass a crafted query string past the \copy (...) parenthesis-balance guard by exploiting a backslash-escape mismatch with psql's default standard_conforming_strings = on behaviour, exposing a live TO PROGRAM clause for arbitrary command execution (CVE-2026-17566).

Bugs/Housekeeping:

• Fix Schema Diff's "Generate Script" and the browser tree's CREATE Script view emitting wrong SQL for SERIAL/identity columns, by detecting column-owned sequences via pg_depend instead of guessing the sequence name.
• Fix ALT+F5 ("Execute query at cursor") doing nothing when the cursor is on or near a statement that is not highlighted, in a Query Tool tab with multiple statements separated by blank lines.
• Fix the object browser's extension UI breaking under PostgreSQL 19's extension catalog changes.
• Detect a selected-but-unusable OS keyring and fall back gracefully instead of failing.
• Warn when OAuth2 provider settings are misplaced at the top level of the config instead of under OAUTH2_CONFIG.
• Honor the selected EOL sequence when copying query text to the clipboard.
• Fix a Schema Diff result-status filter chip showing "No difference found" after being toggled off and back on, even when real differences exist.
• Fix the Object Explorer briefly showing literal HTML markup instead of a greyed-out "[Disconnecting...]" label when disconnecting a server or database.
• Centralize shared-server-group visibility and access-control logic, and adjust the ServerGroup-to-Server/SharedServer model relationships.
• Fail the macOS appbundle build if any bundled library links outside the bundle, and scan all Mach-O binaries for bundle linkage.
• Pin the sonarqube-scan-action GitHub workflow to a full commit SHA, and pin the Yarn version used by the build scripts to the packageManager field.
• Bump JavaScript and Python third-party dependencies, including axios, webpack, react, electron, and certifi.
• Update the Simplified Chinese (zh_Hans_CN) translation.

Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the download area.

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.16. This release of pgAdmin 4 includes 64 bug fixes and new features, including fixes for seven security vulnerabilities (CVE-2026-12044 through CVE-2026-12050). For more details, please see the release notes.

pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website.

Notable changes in this release include:

Features:

• Colorize panel and tab headers based on the connected server's colour, making it easier to identify which server a tab belongs to at a glance.
• Add a "Back to login" link to the Forgot Password and Reset Password pages.
• Add support for the TOAST tuple target storage parameter in the Materialized View dialog.
• Make the init container security context in the Helm chart configurable via containerSecurityContext.
• Add support for closing a tab with a middle-click on its title.
• Allow the OAuth2 login button icon to use any Font Awesome style, not only brand icons.

Security Fixes:

• Fix SQL injection across sixteen dialog templates that rendered COMMENT ON ... IS '<description>'; switches affected templates to qtLiteral and rewrites stats calls to pass the relation OID via a ::oid::regclass cast (CVE-2026-12044).
• Fix an AI Assistant read-only transaction bypass that allowed prompt-injected multi-statement payloads to commit out of the READ ONLY wrapper, chaining to RCE via COPY ... TO PROGRAM on a superuser connection (CVE-2026-12045).
• Fix two SQL Editor endpoints missing the @pga_login_required decorator, making them reachable without authentication in server mode and exposing a pickle deserialization sink (CVE-2026-12046).
• Fix HTML injection in the cloud deployment module (RDS, Azure, Google) where SDK exception text was forwarded to the browser unsanitised and rendered through html-react-parser (CVE-2026-12047).
• Fix critical stored cross-site scripting where PostgreSQL server error text and Explain plan-node content passed through html-react-parser across notifier toasts, form errors, modal alerts, and the Explain visualiser; injected script could exfiltrate saved server credentials and issue SQL against every connected server (CVE-2026-12048).
• Fix an open redirect in the multi-factor authentication flow via an unvalidated next parameter (CVE-2026-12049).
• Fix SQL injection in the named restore point endpoint where the user-supplied restore point name was interpolated into SQL via str.format() instead of a bound parameter (CVE-2026-12050).

Bugs/Housekeeping:

• Remove the administrator-role bypass from server-access helpers so the access-control checks added in 9.15 (CVE-2026-7813) are enforced uniformly.
• Remove EDB BigAnimal cloud deployment support, which was deprecated in 9.15.
• Preserve jsonb number representation in the JSON editor so trailing fractional zeros and large integers are no longer rewritten when saving unmodified rows.
• Fix a View/Edit Data crash when the session contains a transaction object that is not filter-capable, which could prevent the desktop application from loading after an upgrade.
• Rebase version-specific SQL templates so the default targets PostgreSQL 14, the oldest supported server version, dropping obsolete sub-14 template buckets.
• Strip the foreign-architecture slice from the macOS bundle so single-arch builds no longer ship unused code.
• Bump Electron to 42.3.3, cryptography to 49.0, and other Python and JavaScript dependencies.
• Update the Italian translation.

Deprecations:

• pgAgent has been deprecated and will be discontinued. pgAgent will be removed from the website within one month, and support within pgAdmin will be removed approximately six months from now. Users are encouraged to migrate to an alternative job scheduling solution.

Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the download area.