pgAdmin 4.16 Released with Critical Security Patches for Cloud Modules

The pgAdmin Development Team announced the release of version 9.16 of pgAdmin 4 on June 18, 2026, delivering a crucial update that includes fixes for seven security vulnerabilities. This release is particularly significant for users managing PostgreSQL databases in cloud environments, as it addresses an HTML injection flaw, CVE-2026-12047, found in the cloud deployment module. This vulnerability affected pgAdmin 4's integration with major cloud providers such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud. The HTML injection vulnerability arose because pgAdmin 4's cloud deployment module failed to properly sanitize external SDK exception text. When an authenticated user submitted a malformed access key, the cloud provider's SDK would reject it, and the exception message, potentially containing attacker-controlled HTML, was passed unencoded into the JSON response. The Cloud Wizard frontend then rendered this unescaped HTML, allowing an attacker to inject structural HTML directly into the user interface. This could lead to a victim's browser being redirected to an attacker-controlled site, especially if combined with cross-site request forgery (CSRF) attacks. Beyond the HTML injection, pgAdmin 4.16 also resolves other severe security issues. These include CVE-2026-12048, a critical stored cross-site scripting vulnerability that could enable attackers to exfiltrate saved server credentials and execute arbitrary SQL commands on connected servers. Another significant fix is for CVE-2026-12050, an SQL injection flaw in the named restore point endpoint. Additional vulnerabilities addressed cover an AI Assistant read-only transaction bypass (CVE-2026-12045), unauthenticated access to SQL Editor endpoints (CVE-2026-12046), and an open redirect in the multi-factor authentication flow (CVE-2026-12049). The release not only focuses on security but also introduces 64 bug fixes and new features, enhancing the overall usability and stability of pgAdmin 4. Notable improvements include colorized panel and tab headers for easier server identification, the ability to close tabs with a middle-click, and better handling of JSONB number representations. Given the critical nature of the patched vulnerabilities, users are strongly urged to upgrade to pgAdmin 4 version 9.16 immediately to safeguard their PostgreSQL database management operations, particularly those interacting with cloud services.