CVE-2026-116241: pgAdmin 4 allows remote command execution

CVE-2026-116241 is a critical vulnerability in pgAdmin 4, the web console for PostgreSQL management. The Import/Export Data tool in pgAdmin 4 before version 9.19 fails to properly validate backslashes within double-quoted identifiers, allowing an ordinary database user to bypass parenthesis checking and inject a TO PROGRAM clause into the psql \copy (...) command. This enables arbitrary command execution with the privileges of the account running pgAdmin on the hosting machine.

The CVSS score is 9.9 (critical), one of the highest severity levels. The vulnerability was published on NVD on October 30, 2026. It is a bypass of the previous fix for CVE-2026-17566, highlighting the complexity of query validation through web interfaces. The Import/Export Data permission is assigned by default to non-administrator users, significantly increasing exposure. Social media signals confirm information spread within the database administrator community.

Immediate action: upgrade pgAdmin 4 to version 9.19 or later. For environments where immediate upgrade is not possible, restrict Import/Export Data permission to administrators only and carefully monitor queries from ordinary database users. Check pgAdmin and hosting machine logs for unexpected commands. Verify that standard_conforming_strings is enabled in the database, since the vulnerability specifically exploits its absence.