Install pgAdmin 4

About pgAdmin 4

pgAdmin is designed to answer the needs of all users, from writing simple SQL queries to developing complex databases. The graphical interface supports all PostgreSQL features and makes administration easy. The application also includes a syntax highlighting SQL editor, a server-side code editor, an SQL/batch/shell job scheduling agent, support for the Slony-I replication engine and much more. Server connection may be made using TCP/IP or Unix Domain Sockets (on *nix platforms), and may be SSL encrypted for securit...

What's new in 9.15

The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.15. This release of pgAdmin 4 includes 19 bug fixes and new features, including fixes for eight security vulnerabilities (CVE-2026-7813 through CVE-2026-7820). For more details, please see the release notes. pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website. Notable changes in this release include: Features: - Allow the Docker container image to run as a non-default user via the PUID and PGID environment variables. Bugs/Housekeeping: - Fix cross-user data access and shared-server privilege escalation in server mode (CVE-2026-7813). - Tighten Shared Server feature parity, owner-only field handling, and write guards as a follow-up to the data-isolation hardening. - Fix stored cross-site scripting (XSS) via crafted PostgreSQL object names rendered in the Browser Tree and Explain Visualizer (CVE-2026-7814). - Fix SQL injection in the Maintenance tool option values (CVE-2026-7815). - Fix OS command injection in Import/Export query export (CVE-2026-7816). - Fix local-file inclusion and server-side request forgery in the LLM API configuration endpoints (CVE-2026-7817). - Fix unsafe deserialization in the session manager that could lead to remote code execution (CVE-2026-7818). This change also encrypts session files at rest using Fernet, restricts session-file and DATA_DIR permissions to 0o600, switches the session-digest default from SHA-1 to SHA-256, and drops several non-roundtrippable live objects from the session. - Fix...

Read release notes

Version history