pgAdmin

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.16. This release of pgAdmin 4 includes 64 bug fixes and new features, including fixes for seven security vulnerabilities (CVE-2026-12044 through CVE-2026-12050). For more details, please see the release notes.

pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website.

Notable changes in this release include:

Features:

• Colorize panel and tab headers based on the connected server's colour, making it easier to identify which server a tab belongs to at a glance.
• Add a "Back to login" link to the Forgot Password and Reset Password pages.
• Add support for the TOAST tuple target storage parameter in the Materialized View dialog.
• Make the init container security context in the Helm chart configurable via containerSecurityContext.
• Add support for closing a tab with a middle-click on its title.
• Allow the OAuth2 login button icon to use any Font Awesome style, not only brand icons.

Security Fixes:

• Fix SQL injection across sixteen dialog templates that rendered COMMENT ON ... IS '<description>'; switches affected templates to qtLiteral and rewrites stats calls to pass the relation OID via a ::oid::regclass cast (CVE-2026-12044).
• Fix an AI Assistant read-only transaction bypass that allowed prompt-injected multi-statement payloads to commit out of the READ ONLY wrapper, chaining to RCE via COPY ... TO PROGRAM on a superuser connection (CVE-2026-12045).
• Fix two SQL Editor endpoints missing the @pga_login_required decorator, making them reachable without authentication in server mode and exposing a pickle deserialization sink (CVE-2026-12046).
• Fix HTML injection in the cloud deployment module (RDS, Azure, Google) where SDK exception text was forwarded to the browser unsanitised and rendered through html-react-parser (CVE-2026-12047).
• Fix critical stored cross-site scripting where PostgreSQL server error text and Explain plan-node content passed through html-react-parser across notifier toasts, form errors, modal alerts, and the Explain visualiser; injected script could exfiltrate saved server credentials and issue SQL against every connected server (CVE-2026-12048).
• Fix an open redirect in the multi-factor authentication flow via an unvalidated next parameter (CVE-2026-12049).
• Fix SQL injection in the named restore point endpoint where the user-supplied restore point name was interpolated into SQL via str.format() instead of a bound parameter (CVE-2026-12050).

Bugs/Housekeeping:

• Remove the administrator-role bypass from server-access helpers so the access-control checks added in 9.15 (CVE-2026-7813) are enforced uniformly.
• Remove EDB BigAnimal cloud deployment support, which was deprecated in 9.15.
• Preserve jsonb number representation in the JSON editor so trailing fractional zeros and large integers are no longer rewritten when saving unmodified rows.
• Fix a View/Edit Data crash when the session contains a transaction object that is not filter-capable, which could prevent the desktop application from loading after an upgrade.
• Rebase version-specific SQL templates so the default targets PostgreSQL 14, the oldest supported server version, dropping obsolete sub-14 template buckets.
• Strip the foreign-architecture slice from the macOS bundle so single-arch builds no longer ship unused code.
• Bump Electron to 42.3.3, cryptography to 49.0, and other Python and JavaScript dependencies.
• Update the Italian translation.

Deprecations:

• pgAgent has been deprecated and will be discontinued. pgAgent will be removed from the website within one month, and support within pgAdmin will be removed approximately six months from now. Users are encouraged to migrate to an alternative job scheduling solution.

Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the download area.

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.15. This release of pgAdmin 4 includes 19 bug fixes and new features, including fixes for eight security vulnerabilities (CVE-2026-7813 through CVE-2026-7820). For more details, please see the release notes.

pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website.

Notable changes in this release include:

Features:

• Allow the Docker container image to run as a non-default user via the PUID and PGID environment variables.

Bugs/Housekeeping:

• Fix cross-user data access and shared-server privilege escalation in server mode (CVE-2026-7813).
• Tighten Shared Server feature parity, owner-only field handling, and write guards as a follow-up to the data-isolation hardening.
• Fix stored cross-site scripting (XSS) via crafted PostgreSQL object names rendered in the Browser Tree and Explain Visualizer (CVE-2026-7814).
• Fix SQL injection in the Maintenance tool option values (CVE-2026-7815).
• Fix OS command injection in Import/Export query export (CVE-2026-7816).
• Fix local-file inclusion and server-side request forgery in the LLM API configuration endpoints (CVE-2026-7817).
• Fix unsafe deserialization in the session manager that could lead to remote code execution (CVE-2026-7818). This change also encrypts session files at rest using Fernet, restricts session-file and DATA_DIR permissions to 0o600, switches the session-digest default from SHA-1 to SHA-256, and drops several non-roundtrippable live objects from the session.
• Fix symlink-based path traversal in the file manager (CVE-2026-7819).
• Fix account-lockout bypass on Flask-Security's default /login view so the locked field is honored on every authentication path (CVE-2026-7820).
• Use absolute paths for a2enmod and a2enconf in the Debian setup script so it works when /usr/sbin is not on PATH.
• Bump Python and JavaScript runtime/development dependencies, and upgrade ESLint to v10.
• Update the Czech, Italian, Russian, Spanish, and Swedish translations.

Deprecations:

• The BigAnimal cloud deployment integration is deprecated and will be removed in the next version of pgAdmin 4.

Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the tarball area.

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.14. This release of pgAdmin 4 includes 23 bug fixes and new features. For more details, please see the release notes.

Notable changes in this release include:

Features:

• Added support to download binary data from the result grid.
• Added support for custom LLM provider URLs for OpenAI and Anthropic, allowing use of OpenAI-compatible providers such as LM Studio, EXO, and LiteLLM.
• Fixed an issue where AI features (AI Assistant tab, AI Reports menus, and AI Preferences) were visible in the UI even when LLM_ENABLED is set to False.
• Allow copying of text from the AI Assistant chat panel.

Bugs/Housekeeping:

• Fixed an issue where selecting all in the Query Tool's Messages tab would select the entire page content.
• Fixed an issue where OAuth2 authentication fails with 'object has no attribute' if OAUTH2_AUTO_CREATE_USER is False.
• Ensure that the Geometry Viewer refreshes when re-running queries or switching geometry columns, preventing stale data from being displayed.
• Fixed an issue where the default fillfactor value for B-tree indexes was incorrect.
• Fixed an issue where AI Reports are grayed out after setting an API key by auto-selecting the default provider.
• Fixed an issue where AI Assistant does not notify that No API Key or Provider is Set.
• Fixed an issue where AI Reports fail with OpenAI models that do not support the temperature parameter.
• Improve the AI Assistant user prompt to be more descriptive of the actual functionality.
• Fix an issue where the AI Assistant was not retaining conversation context between messages, with chat history compaction to manage token budgets.
• Support /v1/responses for OpenAI models.

Download your copy now!