pgAdmin 4 v9.18 ships four security fixes, all credited to outside researchers
The release also quietly folds in a VS Code-style toggle for the Object Explorer.
The pgAdmin Development Team dropped v9.18 today, September 17th, bundling 29 changes and four freshly patched vulnerabilities in one shot. Two of those holes let someone hijack identities and redirect database connections. The rest round out a year-long run of critical fixes that has turned this open-source PostgreSQL admin tool into something of a security case study.
pgAdmin bills itself as "the leading open-source graphical management tool for PostgreSQL." It runs either as an Electron desktop app or as a server-mode web application, so the actual attack surface depends heavily on how you deploy it. That distinction matters here.
The vulnerabilities
All four CVEs came from outside researchers, and the release notes actually name them. It's a nice signal that pgAdmin's responsible-disclosure program is doing its job.
CVE-2026-86863 is the ugliest of the batch, an authentication bypass in Webserver auth mode. It lets anyone reaching pgAdmin assert any identity, including an administrator's, without ever presenting a credential. The flaw lived in get_user(), which fell back to reading the WEBSERVER_REMOTE_USER header whenever the value was missing from the WSGI environment. A header is nothing more than whatever the client sends, so that's the whole problem. The fix makes header-asserted identities opt-in now, gated behind a trusted-proxy list with an optional shared secret, and refused entirely for accounts whose auth source isn't webserver.
The two injection bugs share a common enemy: libpq's habit of expanding a database name containing an equals sign into a full connection string. It's the same class of flaw that has bothered pgAdmin's Backup and Restore tools for years. CVE-2026-86864 targets the Backup tool, where a database name starting with a dash could smuggle in options like --file, steering output away from the storage-confined path. CVE-2026-86862 hits Restore and Maintenance, redirecting both the connection and the password exported in PGPASSWORD to a server the caller happened to pick. The fixes for both are identical. Pass the name through the PGDATABASE environment variable instead, and libpq never expands it. The fixes are boring by design. That's the point.
The fourth, CVE-2026-86861, is a TOCTOU symlink path traversal in the File Manager. The save_file endpoint validated a path, then opened it with a plain open() call. A symlink planted in between got followed, writing outside your storage directory. It's precisely the write side that the v9.15 hardening of the upload path never touched.
Two more hardening moves made it in, though these aren't separately CVE'd. HTTP redirects on LLM API requests are now refused rather than following a Location header past the ALLOWED_LLM_API_URLS allowlist, and importing a non-shared server with an empty or null username now fails cleanly instead of leaving behind a server that libpq would silently authenticate as whatever OS account happens to run pgAdmin.
Beyond the security sweep
There's one genuinely usable feature hiding in here. Re-clicking the workspace icon now collapses or restores the Object Explorer, mirroring how the VS Code sidebar toggles. The choice survives a page refresh, and there's a Ctrl+Alt+B shortcut you can remap through the new toggle_object_explorer preference.
It's a small thing. It fixes none of the four holes. But after a release this dominated by injection and auth bypass, a working UI toggle feels like a breather.
Keep in mind that the rest of the release is mostly housekeeping and dependency churn, which is exactly what you want from a security patch. The team deliberately held back on a few bumps. paramiko going from 3 to 5 is blocked by sshtunnel's DSSKey usage, and azure-mgmt-resource 26.0.0 drops Python 3.9. On the JavaScript side, they skipped Babel 8 and the webpack 5.110.3 bump, which npm quarantined at the time of the update.
The bigger versions did land, though. The Electron desktop build now sits on 43.4.0, React is up at 19.2.8, and cryptography reached 50.0.*. Bundled PostgreSQL utilities came in at 18.4, and supported servers span PostgreSQL 14 through 18 as well as EDB Advanced Server across the same range.
That context is the real story. v9.15 alone pulled eight vulnerabilities out of pgAdmin, including an unsafe-deserialization RCE and the symlink traversal that eventually became this release's CVE-2026-86861. Versions 9.16 and 9.17 then layered on SQL injection fixes, AI-assistant transaction bypasses, and OS command injection holes in Import and Export. So v9.18 reads less like a fresh start and more like the same war, different battlefield.
Builds for Windows and macOS are available now, along with a Python wheel, Docker image, RPM, DEB package, and a source tarball. The team recommends installing binary packages wherever possible and leans on the PostgreSQL mirror network to do it.
If you're running pgAdmin in server mode and anything can reach it over a network, you should upgrade. The credential-redirection and auth-bypass holes aren't theoretical here.
Head here to the download area when you're ready, and check the security advisories page for the full CVE-by-CVE writeup.
