pgAdmin 4 v9.19 has been released with 136 changes, including 15 critical security fixes addressing vulnerabilities such as OS command injection and credential leakage, primarily affecting server-mode deployments. The update emphasizes a comprehensive re-evaluation of security measures regarding file paths, authentication, and command execution within the tool. New user-facing features include a statistics node, JSON/XML export options, and support for updatable views and pg_timetable management. Server-mode users are advised to upgrade promptly and configure specific settings before the first start to avoid irreversible data loss and ensure proper security measures are in place

pgAdmin 4 v9.19 Released: 15 Security Fixes and 136 Changes for PostgreSQL Admin

pgAdmin 4 v9.19 shipped today with 136 total changes, the most important being 15 security fixes (CVE-2026-116238 through CVE-2026-116252). These vulnerabilities span OS command injection, cross-account identity confusion, credential leakage to the service account and other users, and path-traversal races, with most hitting server-mode deployments. Alongside the security work, the release adds user-facing features like a statistics node, JSON/XML query export, updatable-view editing, and pg_timetable support. Server-mode admins should upgrade promptly, but must configure SERVER_PASSEXEC_COMMANDS before the first start or risk permanently clearing existing commands.

pgAdmin 4 v9.19 Released: 15 Security Fixes and 136 Changes for PostgreSQL Admin @ Linux Compatible