pgAdmin 4

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.17. This release of pgAdmin 4 includes 28 bug fixes and new features, including fixes for seven security vulnerabilities (CVE-2026-17346 through CVE-2026-17351 ... [More] , and CVE-2026-17566). For more details, please see the release notes. pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website. Notable changes in this release include: Features: Include the authenticated user's identity in the HTTP access log. Add an opt-in Gateway API HTTPRoute template to the Helm chart as an alternative to the existing Ingress. Add a preference to cap the row count fetched by the plain "View Data" action, so it is usable on large tables without always doing a full SELECT *. Add support for a custom XYZ tile provider (URL, name, CRS, attribution, max zoom) in the Geometry Viewer, alongside the existing built-in base layers. Security Fixes: Fix a tool-permission bypass where a user denied the Query Tool, Grant Wizard, or Schema Diff permission could still drive that tool's backend routes and Socket.IO handlers directly, since the permission check was applied only to a single "front door" route per tool. Also fixes a non-owner triggering an adhoc connection against another user's shared server persisting a new server record still owned by that other user (CVE-2026-17350). Fix OS command injection in the MASTER_PASSWORD_HOOK feature, where an externally-sourced username (e.g. via OAuth2/OIDC, Kerberos, or webserver authentication) containing shell metacharacters could execute arbitrary commands as the pgAdmin service account when the configured hook string uses %u (CVE-2026-17347). Fix a lexer-differential bypass of the AI Assistant's read-only transaction guard, where sqlparse's string-literal lexing disagreed with PostgreSQL's own parser under standard_conforming_strings = on, letting a crafted multi-statement payload smuggle a COMMIT past the intended read-only wrapper; an incomplete fix for CVE-2026-12045 (CVE-2026-17351). Fix SQL injection in the Index Statistics all-indexes listing and the Publications/Subscriptions Dependencies views, where an apostrophe in a table, index, publication, or subscription name broke out of an unescaped template interpolation; an incomplete fix for CVE-2026-12044 (CVE-2026-17346). Fix several Constraints, Preferences, Debugger, and Schema Diff routes missing the @pga_login_required decorator, making them reachable without authentication in server mode; an incomplete fix for CVE-2026-12046 (CVE-2026-17348). Fix an adhoc server connection cloning another user's stored database credentials (password, save password flag, tunnel password) alongside ownership, letting a non-owner who cloned another user's shared server connect using that user's saved database password (CVE-2026-17349). Fix OS command injection in the Import/Export Data tool, where a query-based export could pass a crafted query string past the \copy (...) parenthesis-balance guard by exploiting a backslash-escape mismatch with psql's default standard_conforming_strings = on behaviour, exposing a live TO PROGRAM clause for arbitrary command execution (CVE-2026-17566). Bugs/Housekeeping: Fix Schema Diff's "Generate Script" and the browser tree's CREATE Script view emitting wrong SQL for SERIAL/identity columns, by detecting column-owned sequences via pg_depend instead of guessing the sequence name. Fix ALT+F5 ("Execute query at cursor") doing nothing when the cursor is on or near a statement that is not highlighted, in a Query Tool tab with multiple statements separated by blank lines. Fix the object browser's extension UI breaking under PostgreSQL 19's extension catalog changes. Detect a selected-but-unusable OS keyring and fall back gracefully instead of failing. Warn when OAuth2 provider settings are misplaced at the top level of the config instead of under OAUTH2_CONFIG. Honor the selected EOL sequence when copying query text to the clipboard. Fix a Schema Diff result-status filter chip showing "No difference found" after being toggled off and back on, even when real differences exist. Fix the Object Explorer briefly showing literal HTML markup instead of a greyed-out "[Disconnecting...]" label when disconnecting a server or database. Centralize shared-server-group visibility and access-control logic, and adjust the ServerGroup-to-Server/SharedServer model relationships. Fail the macOS appbundle build if any bundled library links outside the bundle, and scan all Mach-O binaries for bundle linkage. Pin the sonarqube-scan-action GitHub workflow to a full commit SHA, and pin the Yarn version used by the build scripts to the packageManager field. Bump JavaScript and Python third-party dependencies, including axios, webpack, react, electron, and certifi. Update the Simplified Chinese (zh_Hans_CN) translation. Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the download area. [Read News] [Less]

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.16. This release of pgAdmin 4 includes 64 bug fixes and new features, including fixes for seven security vulnerabilities (CVE-2026-12044 through CVE-2026-12050). ... [More] For more details, please see the release notes. pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website. Notable changes in this release include: Features: Colorize panel and tab headers based on the connected server's colour, making it easier to identify which server a tab belongs to at a glance. Add a "Back to login" link to the Forgot Password and Reset Password pages. Add support for the TOAST tuple target storage parameter in the Materialized View dialog. Make the init container security context in the Helm chart configurable via containerSecurityContext. Add support for closing a tab with a middle-click on its title. Allow the OAuth2 login button icon to use any Font Awesome style, not only brand icons. Security Fixes: Fix SQL injection across sixteen dialog templates that rendered COMMENT ON ... IS ''; switches affected templates to qtLiteral and rewrites stats calls to pass the relation OID via a ::oid::regclass cast (CVE-2026-12044). Fix an AI Assistant read-only transaction bypass that allowed prompt-injected multi-statement payloads to commit out of the READ ONLY wrapper, chaining to RCE via COPY ... TO PROGRAM on a superuser connection (CVE-2026-12045). Fix two SQL Editor endpoints missing the @pga_login_required decorator, making them reachable without authentication in server mode and exposing a pickle deserialization sink (CVE-2026-12046). Fix HTML injection in the cloud deployment module (RDS, Azure, Google) where SDK exception text was forwarded to the browser unsanitised and rendered through html-react-parser (CVE-2026-12047). Fix critical stored cross-site scripting where PostgreSQL server error text and Explain plan-node content passed through html-react-parser across notifier toasts, form errors, modal alerts, and the Explain visualiser; injected script could exfiltrate saved server credentials and issue SQL against every connected server (CVE-2026-12048). Fix an open redirect in the multi-factor authentication flow via an unvalidated next parameter (CVE-2026-12049). Fix SQL injection in the named restore point endpoint where the user-supplied restore point name was interpolated into SQL via str.format() instead of a bound parameter (CVE-2026-12050). Bugs/Housekeeping: Remove the administrator-role bypass from server-access helpers so the access-control checks added in 9.15 (CVE-2026-7813) are enforced uniformly. Remove EDB BigAnimal cloud deployment support, which was deprecated in 9.15. Preserve jsonb number representation in the JSON editor so trailing fractional zeros and large integers are no longer rewritten when saving unmodified rows. Fix a View/Edit Data crash when the session contains a transaction object that is not filter-capable, which could prevent the desktop application from loading after an upgrade. Rebase version-specific SQL templates so the default targets PostgreSQL 14, the oldest supported server version, dropping obsolete sub-14 template buckets. Strip the foreign-architecture slice from the macOS bundle so single-arch builds no longer ship unused code. Bump Electron to 42.3.3, cryptography to 49.0, and other Python and JavaScript dependencies. Update the Italian translation. Deprecations: pgAgent has been deprecated and will be discontinued. pgAgent will be removed from the website within one month, and support within pgAdmin will be removed approximately six months from now. Users are encouraged to migrate to an alternative job scheduling solution. Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the download area. [Read News] [Less]

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.15. This release of pgAdmin 4 includes 19 bug fixes and new features, including fixes for eight security vulnerabilities (CVE-2026-7813 through CVE-2026-7820). For ... [More] more details, please see the release notes. pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website. Notable changes in this release include: Features: Allow the Docker container image to run as a non-default user via the PUID and PGID environment variables. Bugs/Housekeeping: Fix cross-user data access and shared-server privilege escalation in server mode (CVE-2026-7813). Tighten Shared Server feature parity, owner-only field handling, and write guards as a follow-up to the data-isolation hardening. Fix stored cross-site scripting (XSS) via crafted PostgreSQL object names rendered in the Browser Tree and Explain Visualizer (CVE-2026-7814). Fix SQL injection in the Maintenance tool option values (CVE-2026-7815). Fix OS command injection in Import/Export query export (CVE-2026-7816). Fix local-file inclusion and server-side request forgery in the LLM API configuration endpoints (CVE-2026-7817). Fix unsafe deserialization in the session manager that could lead to remote code execution (CVE-2026-7818). This change also encrypts session files at rest using Fernet, restricts session-file and DATA_DIR permissions to 0o600, switches the session-digest default from SHA-1 to SHA-256, and drops several non-roundtrippable live objects from the session. Fix symlink-based path traversal in the file manager (CVE-2026-7819). Fix account-lockout bypass on Flask-Security's default /login view so the locked field is honored on every authentication path (CVE-2026-7820). Use absolute paths for a2enmod and a2enconf in the Debian setup script so it works when /usr/sbin is not on PATH. Bump Python and JavaScript runtime/development dependencies, and upgrade ESLint to v10. Update the Czech, Italian, Russian, Spanish, and Swedish translations. Deprecations: The BigAnimal cloud deployment integration is deprecated and will be removed in the next version of pgAdmin 4. Builds for Windows and macOS are available now, along with a Python Wheel, Docker Container, RPM, DEB Package, and source code tarball from the tarball area. [Read News] [Less]

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.14. This release of pgAdmin 4 includes 23 bug fixes and new features. For more details, please see the release notes. Notable changes in this release include: ... [More] Features: Added support to download binary data from the result grid. Added support for custom LLM provider URLs for OpenAI and Anthropic, allowing use of OpenAI-compatible providers such as LM Studio, EXO, and LiteLLM. Fixed an issue where AI features (AI Assistant tab, AI Reports menus, and AI Preferences) were visible in the UI even when LLM_ENABLED is set to False. Allow copying of text from the AI Assistant chat panel. Bugs/Housekeeping: Fixed an issue where selecting all in the Query Tool's Messages tab would select the entire page content. Fixed an issue where OAuth2 authentication fails with 'object has no attribute' if OAUTH2_AUTO_CREATE_USER is False. Ensure that the Geometry Viewer refreshes when re-running queries or switching geometry columns, preventing stale data from being displayed. Fixed an issue where the default fillfactor value for B-tree indexes was incorrect. Fixed an issue where AI Reports are grayed out after setting an API key by auto-selecting the default provider. Fixed an issue where AI Assistant does not notify that No API Key or Provider is Set. Fixed an issue where AI Reports fail with OpenAI models that do not support the temperature parameter. Improve the AI Assistant user prompt to be more descriptive of the actual functionality. Fix an issue where the AI Assistant was not retaining conversation context between messages, with chat history compaction to manage token budgets. Support /v1/responses for OpenAI models. Download your copy now! [Read News] [Less]

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.13. This release of pgAdmin 4 includes 15 bug fixes and new features. For more details, please see the release notes. Notable changes in this release include: ... [More] Features: Core LLM integration infrastructure, AI reports for security, schema, and performance, AI chat for the Query Tool, and AI Insights for EXPLAIN. No FK are shown in diagrams created from existing tables in the ERD Tool. Add support for 'ONLY' in the Index creation dialog. Allow users to customize "OF TYPE" columns during table creation. Allow "drag-n-drop" for only user chosen tables, and show relations between them. Load predefined users from a JSON file through the command line. Bugs/Housekeeping: Fixed an issue where the 'Quote strings only' configuration was ignored when downloading the result set. Fixed an issue where tools settings changed by the users were not restored on application relaunch. Fixed an issue where modifying a shared server incorrectly updated the original server details. Fixed an issue where a long name in ERD table node was not breaking into multiple lines. Fixed an issue where column comments were not displayed in the SQL tab for materialised views. Fix an issue where deployment of the helm chart was crashing with "operation not permitted." Fix translation compilation. Fix broken checkbox selection in backup dialog's object tree. Fixed an issue in file dialog where renaming was not working. Download your copy now! [Read News] [Less]

The pgAdmin Development Team is pleased to announce pgAdmin 4 version 9.12. This release of pgAdmin 4 includes 3 new features and 21 bug fixes/housekeeping changes. For more details, please see the release notes. Notable changes in this release ... [More] include: Features: Add new options like INHERIT and SET to the Role's membership tab. Add a new button in the query tool data output toolbar to get entire range of data. Enhance OAUTH2 and OIDC authentication support with improved claims handling and configuration options. Bugs/Housekeeping: Mask the secret key for restrict option in the process watcher when restoring plain SQL file (CVE-2026-1707). Fix Query Tool state restoration for new connections and queries. Fix pg_restore logs to distinguish UI sync issues from actual failures. Optimize checkbox selection logic in backup dialog objects tree. Fixed an issue where double click to open a file in the file manager is not working. Ensure saved shared server passwords are re-encrypted on password change. Fixed an issue where the dashboard freezes on initial render when there is a high number of locks. Fixed the SSL certificate issue while checking for the upgrade. Fixed a sorting issue in the system stats memory usage table. Disable Parameters and Membership fields when object is not new for Login and group roles. Fixed an issue where the Query History panel would auto-scroll to the top and did not preserve the scroll bar position for the selected entry. Fixed an issue where pgAdmin4 app on macOS cannot auto-update while running on a read-only volume even if present in the Applications folder. Fixed an issue where connection parameters were using localized values instead of literal values, causing connection failures. Ensure the container deployment supports boolean values in yaml format. Fix pgAdmin fails when performing Backup/Restore on a PostgreSQL connection defined exclusively via pg_service.conf. Download your copy now! [Read News] [Less]

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.11. This release of pgAdmin 4 includes 16 bug fixes and new features. For more details, please see the release notes. Notable changes in this release include: ... [More] Features: Add support of DEPENDS/NO DEPENDS ON EXTENSION for INDEX. Add support of DEPENDS/NO DEPENDS ON EXTENSION for MATERIALIZED VIEW. Add support for showing the column data type beside column name in the object explorer. Added Ubuntu 25.10 and Fedora 43. Add conditional TLS support for the Ingress in the Helm chart. Bugs/Housekeeping: Plain SQL restore runs with '\restrict' option to prevent harmful psql meta-commands (CVE-2025-13780). Fixed an issue on type casting of default string function/procedure arguments in debugger tool. Fix pkg_resources deprecation warning by migrating Docker base image to python:3-alpine from alpine:latest. Fixed an issue where EXPLAIN should run on query under cursor if no text is selected. Fixed an issue where opening file in Query Tool does not retain file name in tab. Fixed an issue where connection is failing via Query Tool/PSQL Tool workspaces. Fixed an issue where copying highlighted text in the query tool data output cell editor would copy the complete string. Fixed an issue where copying a single cell should not add quoting. Fix the Helm chart server definition and change the app version. Specify the correct hostname placeholder for the Password Exec command. Ensure the proper handling of extra volume mount configurations in the Helm deployment template by correcting the configuration value references. Download your copy now! [Read News] [Less]

The pgAdmin Development Team is pleased to announce pgAdmin 4 version 9.10. This release of pgAdmin 4 includes 5 new features and 12 bug fixes/housekeeping changes. For more details, please see the release notes. Notable changes in this release ... [More] include: Features: Added the ability to search for tables and automatically bring them into view in the ERD tool. Add support of DEPENDS/NO DEPENDS ON EXTENSION for PROCEDURE. Add support for setting image download resolution in the ERD tool. Add support for displaying detailed Citus query plans instead of 'Custom Scan' placeholder. Add support for formatting .pgerd ERD project file. Bugs/Housekeeping: Fixed an issue where data output column resize is not sticking in Safari. Fixed an issue where Schema Diff does not ignore Tablespace for indexes. Fixed an issue where the 2FA window redirected to the login page after session expiration. Fixed an issue where the Select All option on the columns tab of import/export data was not working in languages other than English. Fixed an issue where the Debian build process failed with a "Sphinx module not found" error when using a Python virtual environment. Fixed an issue where the last used storage directory was reset to blank, leading to access denied errors during backup or restore operations. Fixed an issue that prevented assigning multiple users to an RLS policy. Fixed remote code execution vulnerability when restoring PLAIN-format SQL dumps in server mode (CVE-2025-12762). Fixed Command injection vulnerability allowing arbitrary command execution on Windows (CVE-2025-12763). Fixed LDAP authentication flow vulnerable to TLS certificate verification bypass (CVE-2025-12765). Fixed LDAP injection vulnerability in LDAP authentication flow (CVE-2025-12764). Migrate pgAdmin UI to use React 19. Download your copy now! [Read News] [Less]

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.9. This release of pgAdmin 4 includes 10 bug fixes and new features. For more details, please see the release notes. Notable changes in this release include: ... [More] Features: Add support of DEPENDS/NO DEPENDS ON EXTENSION for ALTER FUNCTION. Added "MULTIRANGE_TYPE_NAME" option while creating a Range Type. Added "SUBSCRIPT" option while creating an External Type. Added option to skip the password dialog when using an identity file. Added 'failover' and 'two_phase' parameter support in CREATE/ALTER SUBSCRIPTION for PostgreSQL v17+. Add support for initializing the pgAdmin4 Kubernetes Helm chart. Bugs/Housekeeping: Fixed an issue where the query tool displayed 'default' instead of 'null' for null text data in the data output. Fixed an issue where the pgAdmin configuration database wasn't being created on a fresh install when an external database was used for the configuration. Fixed an issue where shortcuts are not working as expected on multiple keyboard layouts. Fixed an issue where saving the newly changed preferences was not reflecting on the preferences tab. Download your copy now! [Read News] [Less]

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.8. This release of pgAdmin 4 includes 10 bug fixes and new features. For more details, please see the release notes. Notable changes in this release include: ... [More] Features: Add menu items for truncating foreign tables. Added Debian Trixie as a supported platform for pgAdmin. Allow user to configure security related gunicorn parameters. Change the default pgAdmin theme to System. Bugs/Housekeeping: Fixed Cross-Origin Opener Policy (COOP) vulnerability in the OAuth 2.0 authentication flow (CVE-2025-9636). Remove usage of BrowserFS as it is deprecated. Pin Paramiko to version 3.5.1 to fix the DSSKey error introduced in the latest release. Fixed an issue where pgAdmin config migration was failing while upgrading to v9.7. Fixed an issue where editor shortcuts fail when using Option key combinations on macOS, due to macOS treating Option+Key as a different key input. Fixed an issue where the pgAdmin configuration database wasn’t being created on a fresh install when an external database was used for the configuration. Download your copy now! [Read News] [Less]