Update pgAdmin 4 to 9.19, released on 29 October 2026. It fixes CVE-2026-116241, which lets a signed-in user run commands on the pgAdmin host, and CVE-2026-116238, which removed the limit on password guesses. Both hit hardest where pgAdmin runs in server mode, which includes the official container and the Python package.
The pgAdmin news post says the release fixes 15 vulnerabilities in all, CVE-2026-116238 through CVE-2026-116252. Neither critical flaw was in CISA KEV on 31 October.
Server Mode or Desktop: Which Installs Are Exposed?
In server mode pgAdmin is a web application that many users can share after they sign in. The server deployment guide says server mode is the default, and the desktop runtime overrides it.
| Install | Mode | CVE-2026-116241 | CVE-2026-116238 | How to reach 9.19 |
|---|---|---|---|---|
| Container dpage/pgadmin4. | Server. | Affected. | Affected. | Pull the 9.19 tag. |
| Python package from PyPI. | Server. | Affected. | Affected. | Upgrade pgadmin4 in its virtual environment. |
| APT or RPM with pgadmin4-web. | Server, after setup-web.sh. | Affected. | Affected. | Upgrade the pgadmin4 packages with apt or yum. |
| Desktop on Windows, macOS or Linux. | Desktop. | Not stated in the record; update anyway. | Not affected. | Install the 9.19 package. |
| RHEL, Rocky or AlmaLinux 8. | Either. | Affected in server mode. | Affected in server mode. | No 9.19 RPM; the repository ends at 9.14. |
The CVE-2026-116238 record says desktop mode is not affected by that flaw. The CVE-2026-116241 record does not say whether desktop mode is affected. It lists every release before 9.19 and names no mode, and its CVSS notes reuse the threat model of CVE-2026-17566: a signed-in user in server mode. Updating desktop installs too is our advice, not a vendor statement.
What Each Flaw Gives an Attacker
CVE-2026-116241, rated 9.9 in CVSS 3.1, is an OS command injection in the Import/Export Data tool. A user hides a closing parenthesis from pgAdmin’s query check with a backslash in a double-quoted identifier. Then psql runs a TO PROGRAM command on the pgAdmin host, as the account that runs pgAdmin.
The attacker needs a pgAdmin login, an ordinary database role and the Import/Export Data permission, which non-administrators get by default. The flaw bypasses the fix for CVE-2026-17566 in 9.18. Our CVE-2026-116241 vulnerability page explains the bug.
CVE-2026-116238, rated 9.2 Critical in CVSS 4.0 and 8.1 High in CVSS 3.1, breaks the lockout. After MAX_LOGIN_ATTEMPTS failed logins, 3 by default, pgAdmin locks an internal account. The record says Flask-Security’s own /login view, or a username typed in another case, skipped that count. An attacker with no account could make unlimited guesses against any internal account, including the administrator’s.
That makes weak passwords a brute force attack target. The CNA notes that a guessed administrator account can create, change and delete users. The fix refuses submissions to Flask-Security’s views with a 405 error and counts every failed internal login.
- CISA KEVNot seenNeither CVE is in catalog version 2026.10.3031 Oct
- NVD analysisUnknownBoth records received on 30 October; NVD shows only the CNA scores31 Oct
- Alerts on XYesFive public posts on 30 and 31 October report CVE-2026-116241 and the 9.19 fix31 Oct
- Brandefense BlackholeYesOne Telegram news-channel digest on 30 October repeats the CVE-2026-116241 record31 Oct
The Blackhole post only repeats the CVE record. pgAdmin’s release notes do not say whether either flaw has been exploited.
Five Steps for the Upgrade
- List every pgAdmin install that people reach over the network: containers, Python installs and hosts with pgadmin4-web. Update those first.
- If users store Password Exec Commands, set SERVER_PASSEXEC_COMMANDS before the first start on 9.19. The 9.19 release notes say any stored command that does not match the list is then cleared for good.
- If servers connect through a PostgreSQL connection service, list it in SERVER_MODE_ALLOWED_SERVICES first. The release notes say that in server mode such servers stop connecting until it is listed.
- Upgrade, then check the version in the About box on every install.
- Until every install runs 9.19, revoke the Import/Export Data permission from roles that do not need it, in the Permissions tab of User Management. For accounts that sign in through LDAP, OAuth2, Kerberos or webserver authentication, the pgAdmin login guide also suggests request rate limits on the reverse proxy.
The pgAdmin RPM page lists 9.14 as the last release for AlmaLinux, RHEL and Rocky Linux 8, so a yum upgrade there will not reach 9.19. Move those hosts to the container, the Python package or a newer OS release.
A shared pgAdmin that answers from the internet is part of your attack surface. Our External Attack Surface Management service scans an organisation’s internet-facing assets within minutes.