Postgres Enterprise Manager 10.5.1 release notes v10.5

Fixed CVE-2026-17566, an OS command injection vulnerability in Import/Export Data. _is_query_parens_balanced() incorrectly treated \' as an escaped quote under standard_conforming_strings=on (the PostgreSQL default), allowing a crafted payload to expose a live TO PROGRAM clause for remote code execution via \copy. The lexer was updated to match psql's actual behavior.

Fixed CVE-2026-17346, a SQL injection vulnerability in the Index Statistics and Pub/Sub views. The fix for CVE-2026-12044 missed sinks allowlisted on the incorrect assumption that schema, table, publication, and subscription names from the browser tree cannot contain apostrophes. All remaining unescaped '{{ name }}' interpolations were converted to use qtLiteral.

Fixed CVE-2026-17351, a lexer bypass in the AI Assistant's read-only guard. A payload exploiting the difference between sqlparse and PostgreSQL string-literal lexing under standard_conforming_strings=on could smuggle DML statements past _validate_readonly_query while PostgreSQL executed them.

Fixed CVE-2026-17347, an OS command injection vulnerability in MASTER_PASSWORD_HOOK. The hook substituted the username for %u and executed with shell=True; a username containing shell metacharacters (possible with OAuth/OIDC or Kerberos authentication) allowed arbitrary command execution. The untrusted value is now passed as a separate argument, never concatenated into the shell string.

Fixed CVE-2026-17350, a tool-permission bypass on backend routes and Socket.IO handlers. Tool permissions were previously enforced only on each tool's "front door" route, while the rest of the backend relied on @pga_login_required alone. Checks are now applied consistently across all routes and handlers for Query Tool, Grant Wizard, Schema Diff, ERD, PSQL, Debugger, Backup/Restore, Import/Export, and Search Objects.

Fixed CVE-2026-17348, a missing @pga_login_required decorator on several routes, an incomplete fix for CVE-2026-12046. The decorator was added to the Constraints nodes, proplist, and delete routes, preferences.get_all_cli, debugger.close, and schema_diff.close.

Added a watchdog thread subsystem to the PEM agent. This thread monitors the other agent threads and can intervene if they become blocked or unresponsive.

Added a two-phase commit protocol to all four notification spoolers (SMTP, SNMP, webhook, and Nagios) to eliminate duplicate alert sends when the PEM database becomes resource-exhausted between the send and its terminal-status commit.

When a PEM report template is selected in the Run Report menu or a scheduled job step, the PEM server and database fields are now auto-selected and locked automatically. PEM reports are hidden entirely on non-PEM servers.

The purge system now deletes data in smaller batches, and the purge process is now throttled to avoid overloading the PEM backend database. This resolves a class of bugs where long-running table locks during purge operations could lead to false-positive "server/agent down" alerts.

Fixed a backward-compatibility regression whereby a new PEM agent failed to register against a PEM server running 10.1.0. Also fixed SSL key and certificate paths being stored as relative rather than absolute paths during agent registration (PEM-6174).

Fixed an issue whereby post_connection_sql was missing on server_options insert, which could leave server connection options in an inconsistent state after registration.

Fixed a qtLiteral requires a connection error when opening the Properties panel for a job step. JobStepView.list and .properties rendered properties.sql without passing conn= to render_template, causing a ValueError after the qtLiteral hardening.

Fixed a dashboard freeze caused by an unhandled re-render loop under certain widget configurations. Also fixed the Permissions panel content being obscured by an overlapping scroll area.

Fixed an issue whereby alert row expansion would collapse or jump to the wrong row on data refresh. Row expansion is now bound to row identity rather than display position.

Fixed an issue whereby the expanded PgTable detail panel showed the wrong table's details after a sort or filter. The detail panel is now bound to row identity rather than display position.

Fixed a NullType crash during Flask-Security's fs_uniquifier reflection on SQLite-backed PEM upgrades.

Fixed a qtLiteral requires a connection error when opening the Properties panel for a job schedule. JobScheduleView.list and .properties rendered properties.sql without passing conn= to render_template, causing a ValueError after the qtLiteral hardening.