--- title: pgAdmin 4 v9.19 Released | daily.dev description: pgAdmin 4 version 9.19 ships 136 bug fixes and new features, including patches for 15 security vulnerabilities, CVE-2026-116238 through CVE-2026-116252. One... canonical: https://daily.dev/posts/pgadmin-4-v9-19-released-et7nvxuev twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: pgAdmin 4 v9.19 Released | daily.dev og:description: pgAdmin 4 version 9.19 ships 136 bug fixes and new features, including patches for 15 security vulnerabilities, CVE-2026-116238 through CVE-2026-116252. One... og:url: https://daily.dev/posts/pgadmin-4-v9-19-released-et7nvxuev og:image: https://api.daily.dev/og/posts/ET7nVXUEv.png og:image:alt: pgAdmin 4 v9.19 Released og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # pgAdmin 4 v9.19 Released **[PostgreSQL](https://daily.dev/sources/postgres)** · 4 min read · 0 upvotes · 0 comments ## Summary pgAdmin 4 version 9.19 ships 136 bug fixes and new features, including patches for 15 security vulnerabilities, CVE-2026-116238 through CVE-2026-116252. One fix addresses an OS command injection in the Import/Export Data tool, where a crafted double-quoted identifier could smuggle a 'TO PROGRAM' clause past the '\copy' guard and run arbitrary commands on the pgAdmin host. Other CVEs cover LDAP/Kerberos account confusion, server-mode credential leaks, and a user's other sessions surviving a password change or reset. New features add a Statistics node, JSON/XML export from the Query Tool, and pg_timetable chain management. A stray Python copy in the Linux packages had broken DEB installs on Ubuntu 26.04. Builds are available for Windows, macOS, Docker, RPM, DEB and source tarball. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does CVE-2026-116241 in pgAdmin 4 affect and how was it exploited? CVE-2026-116241 is an OS command injection in pgAdmin 4's Import/Export Data tool. A query-based export could smuggle a live 'TO PROGRAM' clause past the '\copy' parenthesis guard using a backslash inside a double-quoted identifier, allowing an arbitrary command to run on the pgAdmin host. It was an incomplete fix for the earlier CVE-2026-17566, now fully addressed in pgAdmin 4 v9.19. _Teams patching pgAdmin against command injection track fixes like this one on daily.dev._ ### How many security vulnerabilities does pgAdmin 4 version 9.19 fix? pgAdmin 4 version 9.19 fixes 15 security vulnerabilities, tracked as CVE-2026-116238 through CVE-2026-116252, alongside 136 total bug fixes and new features in the release. The fixes span authentication bypasses, server-mode credential leaks, file path handling, and session management issues. _Admins deciding when to upgrade pgAdmin can follow release and CVE details on daily.dev._ ### What is the SERVER_PASSEXEC_COMMANDS setting new in pgAdmin 4 and what should I do before upgrading? SERVER_PASSEXEC_COMMANDS is a new administrator-defined allowlist replacing the previous free-text Password Exec Commands field in server mode, with commands now running without a shell and with a reduced environment. It must be configured before the first start after upgrading to pgAdmin 4 v9.19, or password exec commands relying on the old free-text setting will stop working. _Admins planning a pgAdmin upgrade can check configuration changes like this on daily.dev._ ## Similar posts on daily.dev - [PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 Released\!](https://daily.dev/posts/postgresql-18-4-17-10-16-14-15-18-and-14-23-released--gahxaz8kn) · PostgreSQL · 11 upvotes · 0 comments - [pgcopydb v0.18](https://daily.dev/posts/pgcopydb-v0-18-p5f6abalo) · Planet PostgreSQL · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#postgresql](https://daily.dev/tags/postgresql) [View this post on daily.dev](https://daily.dev/posts/pgadmin-4-v9-19-released-et7nvxuev) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"pgAdmin 4 v9.19 Released","url":"https://daily.dev/posts/pgadmin-4-v9-19-released-et7nvxuev","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pgadmin-4-v9-19-released-et7nvxuev"},"datePublished":"2026-10-31T02:04:53.268Z","dateModified":"2026-10-31T02:05:22.120Z","description":"pgAdmin 4 version 9.19 ships 136 bug fixes and new features, including patches for 15 security vulnerabilities, CVE-2026-116238 through CVE-2026-116252. One...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"PostgreSQL","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"PostgreSQL","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8dab534748a94108858df41b7ef7fe86","url":"https://daily.dev/sources/postgres"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pgadmin-4-v9-19-released-et7nvxuev","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,postgresql","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"PostgreSQL","item":"https://daily.dev/sources/postgres"},{"@type":"ListItem","position":3,"name":"pgAdmin 4 v9.19 Released"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pgadmin-4-v9-19-released-et7nvxuev#faq","mainEntity":[{"@type":"Question","name":"What does CVE-2026-116241 in pgAdmin 4 affect and how was it exploited?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-116241 is an OS command injection in pgAdmin 4's Import/Export Data tool. A query-based export could smuggle a live 'TO PROGRAM' clause past the '\\copy' parenthesis guard using a backslash inside a double-quoted identifier, allowing an arbitrary command to run on the pgAdmin host. It was an incomplete fix for the earlier CVE-2026-17566, now fully addressed in pgAdmin 4 v9.19. Teams patching pgAdmin against command injection track fixes like this one on daily.dev."}},{"@type":"Question","name":"How many security vulnerabilities does pgAdmin 4 version 9.19 fix?","acceptedAnswer":{"@type":"Answer","text":"pgAdmin 4 version 9.19 fixes 15 security vulnerabilities, tracked as CVE-2026-116238 through CVE-2026-116252, alongside 136 total bug fixes and new features in the release. The fixes span authentication bypasses, server-mode credential leaks, file path handling, and session management issues. Admins deciding when to upgrade pgAdmin can follow release and CVE details on daily.dev."}},{"@type":"Question","name":"What is the SERVER_PASSEXEC_COMMANDS setting new in pgAdmin 4 and what should I do before upgrading?","acceptedAnswer":{"@type":"Answer","text":"SERVER_PASSEXEC_COMMANDS is a new administrator-defined allowlist replacing the previous free-text Password Exec Commands field in server mode, with commands now running without a shell and with a reduced environment. It must be configured before the first start after upgrading to pgAdmin 4 v9.19, or password exec commands relying on the old free-text setting will stop working. Admins planning a pgAdmin upgrade can check configuration changes like this on daily.dev."}}]} ```