pgAdmin 4 v9.19 Released

The pgAdmin Development Team is pleased to announce pgAdmin 4 version 9.19. This release of pgAdmin 4 includes 136 bug fixes and new features, including fixes for 15 security vulnerabilities (CVE-2026-116238 through CVE-2026-116252). For more details please see the [release notes](https://www.pgadmin.org/docs/pgadmin4/9.19/release_notes_9_19.html).

pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the [website](https://www.pgadmin.org/).

Notable changes in this release include:

## Features

* Add a Statistics node for creating and managing extended statistics.
* Allow data to be edited through simple auto-updatable views in View/Edit Data.
* Save Query Tool results as JSON or XML as well as CSV, with a selectable encoding, an optional byte order mark, and a 'copy with headers' option.
* Add support for managing pg_timetable chains and tasks.
* Replace free-text Password Exec Commands in server mode with an administrator-defined allowlist, `SERVER_PASSEXEC_COMMANDS`; the commands run without a shell and with a reduced environment. Configure `SERVER_PASSEXEC_COMMANDS` before the first start after upgrading.
* Add pgEdge Starfleet to the Deploy Cloud Instance wizard.
* Allow the login page to be skipped when OAuth2 is the only authentication source.

## Security Fixes

* Fix OS command injection in the Import/Export Data tool, where a query-based export could smuggle a live `TO PROGRAM` clause past the `\copy` parenthesis guard through a backslash in a double-quoted identifier and run an arbitrary command on the pgAdmin host; an incomplete fix for CVE-2026-17566 (CVE-2026-116241).
* Fix LDAP and Kerberos authentication logging a user in to a different account that shared their username, including the initial administrator (CVE-2026-116239).
* Fix bypasses of the failed-login limit and of pgAdmin's own login, password-change and password-reset checks, through Flask-Security's own views and through username case and second-source handling (CVE-2026-116238).
* Fix connection file paths and parameter keys escaping the user's storage directory, which let a user connect with another user's credentials or key (CVE-2026-116249).
* Stop libpq falling back to the pgAdmin service account's own password file and client certificate in server mode (CVE-2026-116247).
* Restrict connection services in server mode to an administrator-defined allowlist, `SERVER_MODE_ALLOWED_SERVICES` (CVE-2026-116245).
* Stop libpq using the pgAdmin service account's Kerberos credentials in server mode (CVE-2026-116244).
* Stop SSH tunnels using the pgAdmin service account's own SSH identity in server mode (CVE-2026-116242).
* Fix the utility binary-path guard accepting a path under `SHARED_STORAGE`, which let a user have pgAdmin execute a file they placed there (CVE-2026-116243).
* Stop server passwords being left in pgAdmin's own process environment, where another user's session or utility could inherit them (CVE-2026-116246).
* Fix any user able to register a server being able to share it with every other user in server mode (CVE-2026-116248).
* Fix the File Manager and the storage-path tools acting on a different path from the one that was checked (CVE-2026-116240).
* Fix time-of-check to time-of-use symlink, hard-link and FIFO races in the File Manager, Import/Export Servers, Backup, Restore and Import/Export Data file paths (CVE-2026-116250).
* Fix a user's other sessions surviving a password change or administrator reset (CVE-2026-116251).
* Fix connection redirection in the materialized view refresh, where a crafted database name was expanded by libpq into a full connection string (CVE-2026-116252).

## Bugs/Housekeeping

* Fix numerous Schema Diff issues, including SERIAL/BIGSERIAL conversions, renamed function arguments, repeated column comments and identity options, and false differences caused by a dropped column in a referenced table.
* Fix View/Edit Data not handling generated columns properly.
* Fix the MAINTAIN privilege being silently dropped for views and materialised views on PostgreSQL 17 and later.
* Fix Kerberos login failures returning a JSON 500 response, and first-time automatically created Kerberos logins being rejected.
* Fix the Query Tool saving files that were loaded as latin-1 or another non-UTF-8 encoding back as UTF-8.
* Fix the Linux packages shipping a stray copy of Python, which stopped the DEB package installing on Ubuntu 26.04.

Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the [download area](https://www.pgadmin.org/download/).