The pgAdmin Development Team has released pgAdmin 4 v9.18, the latest update to the leading open-source graphical management tool for PostgreSQL. The release bundles 29 bug fixes and new features, and notably patches four security vulnerabilities tracked as CVE-2026-86861 through CVE-2026-86864. Full details are available in the release notes.
Key changes in this release include:
- Collapsible Object Explorer: Re-clicking the current workspace icon now collapses and restores the Object Explorer, mirroring the behavior of the VS Code side bar. The choice is remembered across refreshes.
- Keyboard shortcut:
Ctrl+Alt+Btoggles the Object Explorer by default, and the binding can be changed through the newtoggle_object_explorerpreference. - Hardened Content-Security-Policy: Inline scripts now execute under a per-request nonce instead of a blanket
'unsafe-inline', and'unsafe-eval'has been dropped.style-srcretains'unsafe-inline'because MUI and React inject runtime styles and inline style attributes that cannot carry a nonce. - Development behavior: Development bundles re-add
'unsafe-eval'automatically whenDEBUGis set. - Security fix: An authentication bypass in Webserver was resolved.
For developers running pgAdmin against production PostgreSQL instances, the security fixes are the headline item: an authentication bypass in Webserver can expose managed databases to unauthorized access, and the CSP hardening reduces the attack surface for cross-site scripting in the web UI. Upgrading is strongly recommended, especially for teams exposing pgAdmin beyond a trusted network. The Object Explorer improvements are quality-of-life changes for daily administration, saving screen space on smaller displays and adding keyboard-driven navigation. Administrators who customized browser shortcuts or rely on the DEBUG flag should verify both the new preference and CSP behavior after upgrading. As always, review the complete release notes before deploying to confirm compatibility with your environment.
Source: https://www.postgresql.org/about/news/pgadmin-4-v918-released-3381/