pgAdmin 4 v9.16 Fixes Seven Security Vulnerabilities and Adds New Features

pgAdmin 4 version 9.16 is now available with fixes for seven security vulnerabilities and a wider set of usability and maintenance improvements. The PostgreSQL project says the release includes 64 bug fixes and new features, making it an important update for teams that manage PostgreSQL databases through pgAdmin.

The update addresses vulnerabilities tracked as CVE-2026-12044 through CVE-2026-12050. According to the official pgAdmin 4 v9.16 release notes, the patched issues include SQL injection, stored cross-site scripting, authentication weaknesses, HTML injection, an MFA open redirect, and an AI Assistant read-only transaction bypass.

BEST SPRING 2026 DEALS

Editor's Choice

Private Internet Access

Access content across the globe at the highest speed rate.

70% of our readers choose Private Internet Access

70% of our readers choose ExpressVPN

ExpressVPN

Browse the web from multiple devices with industry-standard security protocols.

Nord VPN

Faster dedicated servers for specific actions (currently at summer discounts)

The release matters because pgAdmin is commonly used as an administrative interface for PostgreSQL. In enterprise and cloud environments, a weakness in pgAdmin can create a serious risk when the tool connects to production databases or runs with elevated database privileges.

Seven CVEs Patched in pgAdmin 4 v9.16

One of the most serious fixes covers CVE-2026-12048, a stored cross-site scripting vulnerability in error-rendering and Explain plan-rendering paths. The NVD entry for CVE-2026-12048 lists a PostgreSQL CNA CVSS 3.1 score of 9.3, rated Critical, and says affected versions include pgAdmin 4 from 6.0 before 9.16.

Another critical issue, CVE-2026-12046, involved two SQL Editor endpoints that were missing a login requirement in server mode. The NVD entry for CVE-2026-12046 lists a PostgreSQL CNA CVSS 3.1 score of 9.0 and says the issue affects pgAdmin 4 from 6.9 before 9.16.

The AI Assistant also received an important security fix. CVE-2026-12045 allowed prompt-injected multi-statement payloads to escape the intended read-only transaction wrapper and execute arbitrary SQL with the connected database role. In high-privilege scenarios, that could be chained with PostgreSQL features such as COPY TO PROGRAM.

Security Fixes at a Glance

In practical terms, the most exposed deployments are likely to be shared server-mode installations, environments where pgAdmin connects to sensitive databases, and setups where administrators use saved server connections. Teams should upgrade quickly and review who can access pgAdmin from internal and external networks.

New Features Improve Multi-Server Management

Security is the main reason to install this release, but pgAdmin 4 v9.16 also brings workflow improvements. The official release announcement highlights new colorized panel and tab headers based on the connected server, which should help administrators avoid mistakes when switching between multiple PostgreSQL instances.

Users can also close a tab with a middle click on its title. This is a small change, but it should make daily use faster for people who keep several Query Tool, dashboard, or object tabs open during database work.

• Panel and tab headers can now use the connected server’s color.
• Tabs can be closed with a middle click.
• Forgot Password and Reset Password pages now include a Back to login link.
• OAuth2 login button icons can use any Font Awesome style.
• The Materialized View dialog now supports the TOAST tuple target storage parameter.

Deployment, Dependency, and pgAgent Changes

The v9.16 documentation also lists dependency updates, including Electron 42.3.3 and cryptography 49.0. The Helm chart now lets teams configure the init container security context through containerSecurityContext, which can help Kubernetes users meet internal deployment policies.

pgAdmin 4 is available in several formats, including Windows, macOS, Linux packages, containers, Python packages, and source code. The official pgAdmin download page recommends binary packages for most users because compiling from source requires more technical knowledge.

Administrators should also note the pgAgent status. The download documentation says pgAgent is deprecated and will not receive further updates, with pg_cron recommended as an alternative job scheduling option.

Why Administrators Should Upgrade Now

pgAdmin 4 v9.16 should be treated as a priority update because it fixes several vulnerabilities that affect administrative workflows. SQL injection and stored XSS flaws are especially sensitive in database tools because users often work with privileged accounts and saved connections.

Organizations should upgrade to v9.16, limit pgAdmin access to trusted users, avoid exposing server-mode deployments to the open internet, and review database roles used by administrators. Teams using the AI Assistant should also review how it accesses database content and whether high-privilege roles are necessary for that workflow.

• Upgrade pgAdmin 4 to version 9.16 or later.
• Review server-mode exposure and restrict access where possible.
• Check which users have saved server connections and elevated database roles.
• Review MFA redirect behavior and authentication settings.
• Plan a pgAgent migration path if your environment still depends on it.

FAQ