pgAdmin

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.15. This release of pgAdmin 4 includes 19 bug fixes and new features, including fixes for eight security vulnerabilities (CVE-2026-7813 through CVE-2026-7820). For more details, please see the release notes.

pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website.

Notable changes in this release include:

Features:

• Allow the Docker container image to run as a non-default user via the PUID and PGID environment variables.

Bugs/Housekeeping:

• Fix cross-user data access and shared-server privilege escalation in server mode (CVE-2026-7813).
• Tighten Shared Server feature parity, owner-only field handling, and write guards as a follow-up to the data-isolation hardening.
• Fix stored cross-site scripting (XSS) via crafted PostgreSQL object names rendered in the Browser Tree and Explain Visualizer (CVE-2026-7814).
• Fix SQL injection in the Maintenance tool option values (CVE-2026-7815).
• Fix OS command injection in Import/Export query export (CVE-2026-7816).
• Fix local-file inclusion and server-side request forgery in the LLM API configuration endpoints (CVE-2026-7817).
• Fix unsafe deserialization in the session manager that could lead to remote code execution (CVE-2026-7818). This change also encrypts session files at rest using Fernet, restricts session-file and DATA_DIR permissions to 0o600, switches the session-digest default from SHA-1 to SHA-256, and drops several non-roundtrippable live objects from the session.
• Fix symlink-based path traversal in the file manager (CVE-2026-7819).
• Fix account-lockout bypass on Flask-Security's default /login view so the locked field is honored on every authentication path (CVE-2026-7820).
• Use absolute paths for a2enmod and a2enconf in the Debian setup script so it works when /usr/sbin is not on PATH.
• Bump Python and JavaScript runtime/development dependencies, and upgrade ESLint to v10.
• Update the Czech, Italian, Russian, Spanish, and Swedish translations.

Deprecations:

• The BigAnimal cloud deployment integration is deprecated and will be removed in the next version of pgAdmin 4.

Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the tarball area.

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.14. This release of pgAdmin 4 includes 23 bug fixes and new features. For more details, please see the release notes.

Notable changes in this release include:

Features:

• Added support to download binary data from the result grid.
• Added support for custom LLM provider URLs for OpenAI and Anthropic, allowing use of OpenAI-compatible providers such as LM Studio, EXO, and LiteLLM.
• Fixed an issue where AI features (AI Assistant tab, AI Reports menus, and AI Preferences) were visible in the UI even when LLM_ENABLED is set to False.
• Allow copying of text from the AI Assistant chat panel.

Bugs/Housekeeping:

• Fixed an issue where selecting all in the Query Tool's Messages tab would select the entire page content.
• Fixed an issue where OAuth2 authentication fails with 'object has no attribute' if OAUTH2_AUTO_CREATE_USER is False.
• Ensure that the Geometry Viewer refreshes when re-running queries or switching geometry columns, preventing stale data from being displayed.
• Fixed an issue where the default fillfactor value for B-tree indexes was incorrect.
• Fixed an issue where AI Reports are grayed out after setting an API key by auto-selecting the default provider.
• Fixed an issue where AI Assistant does not notify that No API Key or Provider is Set.
• Fixed an issue where AI Reports fail with OpenAI models that do not support the temperature parameter.
• Improve the AI Assistant user prompt to be more descriptive of the actual functionality.
• Fix an issue where the AI Assistant was not retaining conversation context between messages, with chat history compaction to manage token budgets.
• Support /v1/responses for OpenAI models.

Download your copy now!