---
title: pgAdmin 4 CVE-2026-116241 (CVSS 9.9): a backslash in a double-quoted identifier gets past the Import/Export \copy check, so any pgAdmin user can run commands on the pgAdmin host | ctxsec
url: https://ctxsec.com/items/pgadmin-cve-2026-116241-import-export-copy-bypass-host-command
description: ""
status: "official CVE (PostgreSQL CNA, Oct 30); fix committed; 9.19 not yet tagged when checked"
published: 2026-10-30
---

> 

[← Cybersecurity News](/news) · [markdown](/items/pgadmin-cve-2026-116241-import-export-copy-bypass-host-command.md)

official CVE (PostgreSQL CNA, Oct 30); fix committed; 9.19 not yet tagged when checked

2026-10-30

### pgAdmin 4 CVE-2026-116241 (CVSS 9.9): a backslash in a double-quoted identifier gets past the Import/Export \copy check, so any pgAdmin user can run commands on the pgAdmin host

The PostgreSQL CNA published **CVE-2026-116241** on Oct 30. It bypasses an earlier fix (CVE-2026-17566) in pgAdmin 4's **Import/Export Data** tool, which wraps a query export in `psql \copy (...) TO` and checks that the parentheses balance.

- **Bug:** the check treated a backslash inside a double-quoted identifier as harmless. With `standard_conforming_strings` off, psql treats it as an escape, so a hidden closing parenthesis ends the wrapper and a following `TO PROGRAM` clause runs on the pgAdmin host as the pgAdmin OS account.
- **Who can do it:** any authenticated pgAdmin user with the Import/Export permission (granted by default) and an ordinary database role. CVSS 3.1 9.9 (scope changed).
- **Fix:** versions below 9.19 are affected. The fix is in commit `9be31a0`. When we checked, the newest pgAdmin release tag was still REL-9_18.

**Until 9.19 ships:** remove the Import/Export permission from users who don't need it, and treat multi-user pgAdmin servers as a path to the host and to every database credential saved in them.

Sources: [CVE-2026-116241 record (CNA: PostgreSQL)](https://www.cve.org/CVERecord?id=CVE-2026-116241) · [pgAdmin issue #10663](https://github.com/pgadmin-org/pgadmin4/issues/10663) · [Fix commit 9be31a0](https://github.com/pgadmin-org/pgadmin4/commit/9be31a019f780647fb689c458408c8803263c812)