pgAdmin 4 Import/Export Data Command Injection (CVE-2026-116241)

The CVE record says a signed-in pgAdmin 4 user can make psql run an operating system command on the pgAdmin host, "as the operating-system account running pgAdmin." The user needs only an ordinary database role and the Import/Export Data permission. The record says pgAdmin grants that permission to non-administrators by default.

pgAdmin is the open source administration tool for PostgreSQL. The PostgreSQL CNA scores this flaw 9.9 Critical in CVSS 3.1 and 9.4 Critical in CVSS 4.0. The record credits Yonghwa Lee of Xint by Theori with finding it.

How the Bypass Works

The Import/Export Data tool can export the result of a query. pgAdmin wraps that query in a psql \copy (...) TO command. Before it runs the command, pgAdmin checks that the parentheses in the query are balanced, so nothing can escape the wrapper.

The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier. psql reads quotes differently when the setting standard_conforming_strings is off. A backslash then escapes the double quote, so the identifier does not end where pgAdmin thinks it does.

The CVE record says any ordinary database role can turn that setting off for itself. A closing parenthesis hidden from the check then ends the \copy (...) wrapper early. Then psql runs the TO PROGRAM clause that follows on the pgAdmin host, before the database server rejects the statement.

The Same Guard, Fixed Again

The record calls CVE-2026-116241 a bypass of the fix for CVE-2026-17566. That earlier flaw, fixed in pgAdmin 4 9.18, got past the same parenthesis check with a backslash in a single-quoted string. The CVE-2026-17566 record names CVE-2025-12762 and CVE-2025-13780 as the same class of bug.

The 9.19 fix rejects any backslash inside a double-quoted identifier. The record explains why: what such a backslash means depends on a server setting that pgAdmin cannot know for sure when it checks the query. The release notes add that a backslash or null byte in the schema, table or column names of an export or import is now refused too.

Who Is Most at Risk?

The risk is highest on a shared pgAdmin in server mode, where many people sign in to one install. There, any user with the default permission can run commands as the pgAdmin service account. The CNA's CVSS 4.0 notes also rate the impact High for systems reachable from that host with its credentials.

The pgAdmin server deployment guide says server mode is the default configuration, and the desktop runtime overrides it. The official container and the Python package both run in server mode.

The record does not say whether desktop mode is affected. Its CVSS notes reuse the threat model of CVE-2026-17566, a signed-in user in server mode. Updating desktop installs too is our advice, not a vendor statement.

The same release fixed CVE-2026-116238, which let attackers get past the failed login limit in server mode. Our pgAdmin 9.19 update guide covers both flaws and the update path for each package type.

What Our Checks Showed

These are the public signals we checked on 31 October 2026.

The Blackhole post is a daily digest of critical CVEs on a Telegram news channel. It adds nothing beyond the CVE record. pgAdmin's release notes do not say whether anyone has exploited the flaw.

Other recent flaws also let attackers run commands through a management tool, such as the Arista VeloCloud Orchestrator command injection. Our remote code execution glossary entry explains what an attacker can do with that kind of access.

The CVE record lists every pgAdmin 4 release before 9.19 as affected, and 9.19 as the fix. On 29 October 2026, pgAdmin released 9.19 for all the package types it ships.

The container download page says the image runs pgAdmin in server mode. The Python package page says the same for the PyPI package. On Docker Hub, the 9.19 and latest tags were both updated on 29 October.

The pgAdmin RPM page lists 9.14 as the last release for AlmaLinux, RHEL and Rocky Linux 8. A yum upgrade on those hosts will not reach 9.19. Move them to the container, the Python package or a newer OS release.

The upgrade also changes how some server-mode setups behave. The release notes say to set SERVER_PASSEXEC_COMMANDS before the first start on 9.19. On that start, every stored Password Exec Command that does not match the list is cleared, and that cannot be undone. Our vulnerability management guide covers how to plan and check a rollout.