pgAdmin 9.18 fixes authentication and database-tool security flaws

pgAdmin 9.18 fixes four security vulnerabilities in the PostgreSQL management interface, including a Webserver authentication bypass and unsafe handling of database names in backup and maintenance operations. The release also tightens browser script policy and repairs schema-comparison behavior. Administrators should review their deployment mode and upgrade path, especially where pgAdmin is shared or remotely accessible.

pgAdmin Development Team · Sep 17, 2026

Why it matters

An administrative interface can expose powerful database credentials even when the database itself is configured correctly.

More context

The authentication fix makes header-based identity explicit and limits it to configured trusted proxies. Other fixes address connection redirection and a file-write race. Published packages include desktop builds, containers and a Python wheel. Prioritize a tested upgrade and check reverse-proxy authentication settings against the release notes.

Keep in mind

Exposure depends on configuration and reachable functionality. These are pgAdmin fixes, not a claim that PostgreSQL’s server engine has the same vulnerabilities. 1min has not tested the patches.

Original read