CVE-2026-116241: Import/Export Data tool (psql \copy query-export guard)
pgAdmin's parenthesis-balance guard for query exports did not reject a backslash inside a double-quoted identifier. With standard_conforming_strings off, psql parses the quoting differently, so a hidden closing parenthesis ends the \copy (...) wrapper and a following TO PROGRAM clause runs as the pgAdmin OS account. It bypasses the fix for CVE-2026-17566, and 9.19 fixes it along with CVE-2026-116238 through CVE-2026-116252.
Executive Summary & Technical Impact
pgAdmin's parenthesis-balance guard for query exports did not reject a backslash inside a double-quoted identifier. With standard_conforming_strings off, psql parses the quoting differently, so a hidden closing parenthesis ends the \copy (...) wrapper and a following TO PROGRAM clause runs as the pgAdmin OS account. It bypasses the fix for CVE-2026-17566, and 9.19 fixes it along with CVE-2026-116238 through CVE-2026-116252.
Tracked under CVE-2026-116241 (CWE-78 (OS Command Injection)), this vulnerability affects pgAdmin 4 before 9.19 and carries a severity score of 9.9 (CVSS 3.1, PostgreSQL CNA) (CRITICAL). Engineering and security operations teams running pgAdmin 4 should prioritize upgrading to pgAdmin 4 9.19 (released 2026-10-29).
Remediation & Patch Guidance
- Upgrade pgAdmin 4 to 9.19 (desktop, server packages and container images). Review the release notes for behaviour changes in server mode.
- Until then, revoke the tools_import_export_data permission from untrusted roles.
- If untrusted users could reach a vulnerable server-mode instance, rotate the database credentials saved in it.
Frequently Asked Questions (CVE-2026-116241)
What versions are affected by CVE-2026-116241?
CVE-2026-116241 affects pgAdmin 4 before 9.19 in pgAdmin 4 (Import/Export Data tool (psql \copy query-export guard)).
How do I patch or remediate CVE-2026-116241?
Upgrade affected deployments to pgAdmin 4 9.19 (released 2026-10-29) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-116241?
CVE-2026-116241 is rated CRITICAL with a CVSS score of 9.9 (CVSS 3.1, PostgreSQL CNA) (vector: Network, low privilege; any pgAdmin user with the default Import/Export permission who sets standard_conforming_strings off for their own session).
Two Critical Bugs in Dev Infrastructure Control Planes: LXD/MicroCloud CVE-2026-112816 and pgAdmin CVE-2026-116241
A CVSS 10.0 mTLS certificate-chain flaw lets attackers impersonate trusted LXD clients and MicroCloud members, and a CVSS 9.9 pgAdmin import/export injection hands low-privilege users OS command execution. Both were fixed on October 29.
Read full engineering post-mortem (6 min read) →