The PostgreSQL CNA published CVE-2026-116241 on Oct 30. It bypasses an earlier fix (CVE-2026-17566) in pgAdmin 4's Import/Export Data tool, which wraps a query export in psql \copy (...) TO and checks that the parentheses balance.

• Bug: the check treated a backslash inside a double-quoted identifier as harmless. With standard_conforming_strings off, psql treats it as an escape, so a hidden closing parenthesis ends the wrapper and a following TO PROGRAM clause runs on the pgAdmin host as the pgAdmin OS account.
• Who can do it: any authenticated pgAdmin user with the Import/Export permission (granted by default) and an ordinary database role. CVSS 3.1 9.9 (scope changed).
• Fix: versions below 9.19 are affected. The fix is in commit 9be31a0. When we checked, the newest pgAdmin release tag was still REL-9_18.

Until 9.19 ships: remove the Import/Export permission from users who don't need it, and treat multi-user pgAdmin servers as a path to the host and to every database credential saved in them.