Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wMTlj-0007hb-2I for pgsql-announce@arkaria.postgresql.org; Mon, 11 May 2026 16:46:12 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wMTli-001h21-1Y for pgsql-announce@arkaria.postgresql.org; Mon, 11 May 2026 16:46:10 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wMTlh-001h1F-1g for pgsql-announce@lists.postgresql.org; Mon, 11 May 2026 16:46:09 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wMTle-000000004nA-2IiA for pgsql-announce@lists.postgresql.org; Mon, 11 May 2026 16:46:09 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Message-ID:Date:Reply-To:From:To:Subject: MIME-Version:Content-Type:Sender:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=DsynOvnadK0Iv79ZIGHzVg4TOk7k1IG42oHa3D+Utf4=; b=ohVDShApNq2iyu0dG9IveQtQbc x9uAV4xsNsLCW35P3X3eA7WcvkeGxx4qyc+8C3XFAm3KPw2WRfgJMwosrP48bIB07U7eR9XDWnju9 Wq1CkSPbNZnDiFqrzKHSGRIgnGW7AusPEhzsj8T/G7xKoO6x20FaGLJtEsqF57ClaGEVIqYUBu4i7 RKO17pJ0Z2AyByWNFlAq216l4N8ph7HnH0wW0B8z4ZPA8FelWVDijXgnF+H/px/U4ERwwGkGr2cIH mLL4wBldYLc5RjsbGoR8FE2NQ1m9mTubRyLK8rB85vzGEEv49KQFBowCWXKgU0Myh03OCZqOOo90R rd6Kmz6A==; Received: from wrigleys.postgresql.org ([217.196.149.60]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wMTld-000BDg-03 for pgsql-announce@lists.postgresql.org; Mon, 11 May 2026 16:46:05 +0000 Received: from localhost ([127.0.0.1] helo=wrigleys.postgresql.org) by wrigleys.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wMTla-000O5n-0U for pgsql-announce@lists.postgresql.org; Mon, 11 May 2026 16:46:03 +0000 Content-Type: multipart/alternative; boundary="===============8196487897871356956==" MIME-Version: 1.0 Subject: pgAdmin 4 v9.15 Released To: PostgreSQL Announce From: pgAdmin Development Team via PostgreSQL Announce Reply-To: news@pgadmin.org Date: Mon, 11 May 2026 16:45:42 +0000 Message-ID: <177851794230.851.10919277514111552494@wrigleys.postgresql.org> X-Auto-Response-Suppress: All Auto-Submitted: auto-generated X-pglister-tags: related X-pglister-tagsig: 501a64dbadfa982ec592edb3e623f6ddf1bd0896fbc171412a4800a66affeb35 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============8196487897871356956== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable The pgAdmin Development Team is pleased to announce pgAdmin 4 version 9.15. This release of pgAdmin 4 includes 19 bug fixes and new features. For more = details please see the release notes at: pgAdmin is the leading Open Source graphical management tool for PostgreSQL= . For more information, please see: **Notable changes in this release include:** ## Features - Allow the Docker container image to run as a non-default user via the `PU= ID` and `PGID` environment variables. ## Bugs/Housekeeping - Fix cross-user data access and shared-server privilege escalation in serv= er mode (**CVE-2026-7813**). - Tighten Shared Server feature parity, owner-only field handling, and writ= e guards as a follow-up to the data-isolation hardening. - Fix stored cross-site scripting (XSS) via crafted PostgreSQL object names= rendered in the Browser Tree and Explain Visualizer (**CVE-2026-7814**). - Fix SQL injection in the Maintenance tool option values (**CVE-2026-7815*= *). - Fix OS command injection in Import/Export query export (**CVE-2026-7816**= ). - Fix local-file inclusion and server-side request forgery in the LLM API c= onfiguration endpoints (**CVE-2026-7817**). - Fix unsafe deserialization in the session manager that could lead to remo= te code execution (**CVE-2026-7818**). This change also encrypts session fi= les at rest using Fernet, restricts session-file and `DATA_DIR` permissions= to `0o600`, switches the session-digest default from SHA-1 to SHA-256, and= drops several non-roundtrippable live objects from the session. - Fix symlink-based path traversal in the file manager (**CVE-2026-7819**). - Fix account-lockout bypass on Flask-Security's default `/login` view so t= he `locked` field is honored on every authentication path (**CVE-2026-7820*= *). - Use absolute paths for `a2enmod` and `a2enconf` in the Debian setup scrip= t so it works when `/usr/sbin` is not on `PATH`. - Bump Python and JavaScript runtime/development dependencies, and upgrade = ESLint to v10. - Update the Czech, Italian, Russian, Spanish, and Swedish translations. ## Deprecations - The **BigAnimal** cloud deployment integration is deprecated and will be = removed in the next version of pgAdmin 4. --- Builds for Windows and macOS are available now, along with a Python Wheel, = Docker Container, RPM, DEB Package, and source code tarball from: --===============8196487897871356956== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable pgAdmin 4 v9.15 Released
 

pgAdmin 4 v9.15 Released

The pgAdmin Development Team is pleased to = announce pgAdmin 4 version 9.15.

This release of pgAdmin 4 includes 19 bug f= ixes and new features. For more details please see the release notes at:

https://www.pgadmin.org/docs/pgadmin4/9.15/release_notes_9_15= .html

pgAdmin is the leading Open Source graphica= l management tool for PostgreSQL. For more information, please see:

https://www.pgadmin.org/

Notable changes in this release inc= lude:

Features

  • Allow the Docke= r container image to run as a non-default user via the PUID an= d PGID environment variables.

Bugs/Housekeeping

  • Fix cross-user = data access and shared-server privilege escalation in server mode (= CVE-2026-7813).
  • Tighten Shared = Server feature parity, owner-only field handling, and write guards as a fol= low-up to the data-isolation hardening.
  • Fix stored cros= s-site scripting (XSS) via crafted PostgreSQL object names rendered in the = Browser Tree and Explain Visualizer (CVE-2026-7814).
  • Fix SQL injecti= on in the Maintenance tool option values (CVE-2026-7815).<= /li>
  • Fix OS command = injection in Import/Export query export (CVE-2026-7816).
  • Fix local-file = inclusion and server-side request forgery in the LLM API configuration endp= oints (CVE-2026-7817).
  • Fix unsafe dese= rialization in the session manager that could lead to remote code execution= (CVE-2026-7818). This change also encrypts session files = at rest using Fernet, restricts session-file and DATA_DIR perm= issions to 0o600, switches the session-digest default from SHA= -1 to SHA-256, and drops several non-roundtrippable live objects from the s= ession.
  • Fix symlink-bas= ed path traversal in the file manager (CVE-2026-7819).
  • Fix account-loc= kout bypass on Flask-Security's default /login view so the locked field is honored on every authentication path (CVE= -2026-7820).
  • Use absolute pa= ths for a2enmod and a2enconf in the Debian setup = script so it works when /usr/sbin is not on PATH.=
  • Bump Python and= JavaScript runtime/development dependencies, and upgrade ESLint to v10.
  • Update the Czec= h, Italian, Russian, Spanish, and Swedish translations.

Deprecations

  • The Big= Animal cloud deployment integration is deprecated and will be remo= ved in the next version of pgAdmin 4.

Builds for Windows and macOS are available = now, along with a Python Wheel, Docker Container, RPM, DEB Package, and sou= rce code tarball from:

https://www.pgadmin= .org/download/
This email was sent to you from pgAdmin Development Team. It was delivered = on their behalf by the PostgreSQL project. Any questions about the content of the message shou= ld be sent to pgAdmin Development Team.

You were sent this email as a subscriber of the pgsql-announce mai= linglist, for the content tag Related Open Source. To unsubscribe from further emails, or change which emails you want to receive, please click th= e personal unsubscribe link that you can find in the headers of this email, or visit https://lists.postgresql.org/unsubscribe/.
 
--===============8196487897871356956==--