Zero Radar
← feed
CriticalVulnerabilityCVE-2026-116241updated 30 Oct 2026, 20:20 UTC

pgAdmin lets database users run commands on the pgAdmin computer

A flaw in pgAdmin's data export tool can let a logged-in database user sneak extra commands past its checks. Those commands run on the computer where pgAdmin is installed, not inside the database.

Fix available · out Official source
SeverityCriticalCVSS 9.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YespgAdmin 4 9.19 or later (the fix rejects any backslash inside a double-quoted identifier) · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Database userHolds export permission by default
  2. 2Crafted export queryDouble-quoted identifier with backslash
  3. 3Quote check fooledParenthesis escapes the \copy wrapper
  4. 4psql runs TO PROGRAMExecutes on pgAdmin host
  5. ResultAttacker runs commands on pgAdmin host

What happened

pgAdmin 4's Import/Export Data tool wraps query exports in a psql \copy command and checks quote balance, but mishandles backslashes inside double-quoted identifiers when standard_conforming_strings is off. This lets a closing parenthesis escape the wrapper and a TO PROGRAM clause run through psql on the pgAdmin host. It is a bypass of the earlier fix for CVE-2026-17566.

Why it is dangerous: The commands run as the operating-system account running pgAdmin, so an ordinary database user with export access could take over that machine. Non-administrator roles get the Import/Export Data permission by default, which widens who can reach this.

Are you affected?

You are affected if you run pgAdmin 4 before version 9.19 and users have the Import/Export Data permission.

pgAdmin 4 before 9.19

What to do

  1. Update pgAdmin 4 to version 9.19 or later
  2. Until updated, restrict the Import/Export Data permission to trusted users only
  3. Review pgAdmin host accounts and logs for unexpected command execution

Timeline

  1. 30 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 30 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 20:20 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116241
CVSS
9.4 / 10
Disclosed
30 Oct 2026, 20:17 UTC
On Zero Radar
30 Oct 2026, 20:20 UTC (3 min after disclosure)
Last change
30 Oct 2026, 20:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

pgAdmin lets database users run commands on the pgAdmin computer · Zero Radar