pgAdmin 4 Released with Patches for Seven Vulnerabilities and Feature Enhancements

pgAdmin 4 version 9.16 has been released by the pgAdmin Development Team, introducing significant security improvements along with feature enhancements and bug fixes.

This update addresses seven vulnerabilities, tracked as CVE-2026-12044 through CVE-2026-12050, and includes 64 bug fixes and various usability upgrades.

As one of the most widely used open-source management tools for PostgreSQL environments, this release has important implications for administrators and developers who rely on pgAdmin for database operations.

The most critical fixes focus on high-risk injection and authentication vulnerabilities. CVE-2026-12044 resolves a SQL injection issue affecting sixteen dialog templates, where improperly sanitized statements could be exploited.

This patch replaces unsafe string handling with `qtLiteral` and introduces safer query processing using relation OID casting. Another severe issue, CVE-2026-12045, addresses a read-only transaction bypass in the AI Assistant that allowed attackers to execute multi-statement payloads.

In certain configurations, this flaw could escalate to remote code execution via the COPY TO PROGRAM command when used with superuser privileges.

Additionally, authentication and access control weaknesses have been addressed. CVE-2026-12046 fixes two SQL Editor endpoints lacking proper authentication enforcement, potentially exposing a pickle deserialization attack vector.

CVE-2026-12049 resolves an open redirect vulnerability in the multi-factor authentication workflow due to improper validation of the “ ” parameter.

Client-side injection risks have also been significantly reduced in this release. CVE-2026-12047 addresses HTML injection in cloud deployment integrations, where unsanitized SDK exception messages were rendered in the browser.

More importantly, CVE-2026-12048 patches a stored cross-site scripting (XSS) vulnerability affecting multiple UI components, including error notifications and the Explain visualizer. Successful exploitation of this vulnerability could allow attackers to exfiltrate stored credentials and execute arbitrary SQL queries on connected database servers.

Another SQL injection flaw, CVE-2026-12050, was fixed in the named restore point functionality, where user input was improperly embedded in SQL queries via string formatting rather than parameterized statements.

Beyond security fixes, pgAdmin 4 v9.16 introduces several usability and feature enhancements. These include server-based color-coded tabs for easier , middle-click tab closing, improved OAuth2 icon customization, and support for TOAST tuple storage parameters in materialized views. Kubernetes users will benefit from configurable container security contexts in Helm deployments.

The release also includes dependency updates, such as Electron 42.3.3 and cryptography 49.0, along with backend improvements, such as standardized PostgreSQL 14 template targeting and the removal of deprecated components. Notably, pgAgent has been officially deprecated and will be phased out in the coming months.

Security professionals and database administrators are strongly advised to promptly upgrade to pgAdmin 4 v9.16, as several of the patched vulnerabilities could lead to privilege escalation, data exfiltration, or remote code execution in exposed environments.

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

A supply-chain weakness in ClawHub’s plugin registry that allowed third-party packages to squat under organizational…

QNAP has issued security advisory QSA-26-10, which addresses 14 vulnerabilities affecting its widely used NAS…

Microsoft has announced a significant update to its Microsoft 365 ecosystem to enhance data protection.…

A malicious npm package, postcss-minify-selector-parser, has been discovered masquerading as a benign PostCSS utility and…

A suspicious file named “GST Debit Note Apr_26.com,” which triggered a deeper investigation and revealed…

Researchers have uncovered a systemic LLM credential exposure problem in the iOS ecosystem, with 282…