DATABASES Signal 420
pgAdmin 4 v9.17 Released
pgAdmin 4 v9.17 ships 28 fixes including patches for seven security vulnerabilities, several of which are incomplete fixes for earlier CVEs, along with a handful of operational features.
Two of the fixed vulnerabilities allow OS command injection as the pgAdmin service account, one via the MASTER_PASSWORD_HOOK with externally-sourced usernames, another via the Import/Export tool's \copy handler, making this a high-priority upgrade for any pgAdmin deployment exposed to untrusted users. The recurrence of incomplete patches (CVE-2026-17346, CVE-2026-17348, CVE-2026-17351 all extend prior CVEs) signals that the attack surface around authentication guards and SQL parsing remains active.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Seven security fixes address OS command injection, SQL injection, authentication bypass, and credential leakage, with three being second attempts at previously patched vulnerabilities.
New features include a row-count cap for the plain View Data action, an opt-in Gateway API HTTPRoute template for the Helm chart, and authenticated-user identity in HTTP access logs.
Several bug fixes target PostgreSQL 19 compatibility, Schema Diff SQL generation for identity columns, and graceful fallback when the OS keyring is unavailable.
THE CLUSTER