Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials
pgAdmin 4 versions 6.2-9.17 contain critical auth bypass CVE-2026-86863 (CVSS 9.8) letting unauthenticated attackers impersonate administrators; fixed in 9.18.
A critical authentication bypass (CVE-2026-86863, CVSS 3.1 score 9.8) affects pgAdmin 4 versions 6.2 through 9.17 when Webserver authentication is enabled in AUTHENTICATION_SOURCES. The WebserverAuthentication.get_user() function falls back to client-controlled HTTP headers such as X-Forwarded-User when the WEBSERVER_REMOTE_USER environment variable is absent, allowing unauthenticated remote attackers to log in as any user, including administrators, without a password or MFA. Successful attackers could view, alter, or delete PostgreSQL database objects and data accessible through the hijacked privileged session. Version 9.18 fixes the issue by trusting only genuine CGI/WSGI environment variables by default and requiring explicit options like WEBSERVER_REMOTE_USER_FROM_HEADER with trusted proxies for header-based identity.
- CVE-2026-86863 rated Critical: 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0); no privileges or user interaction needed.
- Only deployments using pgAdmin's Webserver authentication mode with header fallback are affected.
- Fix in 9.18 distinguishes trusted WSGI variables from headers and validates the socket peer address.
- Administrators urged to upgrade, restrict identity headers to trusted proxies, and audit logs for anomalous admin sessions.
- Flaw reported by researcher Sanghyeon Lee, also known as h9e0n.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-86863 | Authentication Bypass via Client-Supplied Header Spoofing in pgAdmin 4 CVE-2026-86863 is a critical authentication bypass (CVSS 4.0: 9.3) in the Webserver authentication source of pgAdmin 4, the standard web-based administration tool for PostgreSQL. When 'webserver' is enabled in AUTHENTICATION_SOURCES, pgAdmin accepted an identity from the WSGI/CGI environment and, when that was empty, fell back to reading the configured identity header directly from the inbound HTTP request, so any client who could reach the pgAdmin interface could supply a header such as X-Forwarded-User (or the name configured in WEBSERVER_REMOTE_USER, e.g. HTTP_X_FORWARDED_USER) and be logged in as any named user, including an existing Administrator, without a password. An attacker therefore gains full control of pgAdmin, including access to the PostgreSQL servers and stored connection details it manages. Only deployments running pgAdmin 4 from version 6.2 up to (but not including) 9.18 with the 'webserver' authentication source enabled are affected; deployments using only internal, LDAP, or OAuth2 authentication are not. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known. Do: Upgrade to pgAdmin 4 9.18 or later, which only trusts genuine WSGI/CGI variables and adds the WEBSERVER_TRUSTED_PROXIES (real socket peer check), WEBSERVER_REMOTE_USER_FROM_HEADER opt-in, and WEBSERVER_SHARED_SECRET controls. As interim mitigation, remove 'webserver' from AUTHENTICATION_SOURCES, or ensure the fronting proxy overwrites/strips the identity header and that pgAdmin is not directly reachable bypassing the proxy. Review pgAdmin logs for logins to webserver-authenticated accounts, especially Administrator, from unexpected source addresses. | 9.3 | — |
| moderate≈10,000–100,000 deployments (the opt-in 'webserver' auth subset of pgAdmin's multi-million-user installed base) |
Full article595 words · extracted from gbhackers.com · click to collapse
A critical vulnerability in pgAdmin 4 could allow unauthenticated remote attackers to impersonate arbitrary users, including existing administrator accounts, by supplying a malicious HTTP identity header.
This vulnerability, tracked as CVE-2026-86863, affects installations using pgAdmin’s Webserver authentication mode and has a CVSS 3.1 score of 9.8 out of 10.
The issue impacts pgAdmin 4 versions 6.2 through 9.17 and has been addressed in pgAdmin 4 version 9.18.
Critical pgAdmin Authentication Bypass
pgAdmin’s Webserver authentication source is intended for deployments where an upstream web server or reverse proxy authenticates a user before forwarding requests to pgAdmin. The upstream component provides the authenticated username through a CGI or WSGI environment variable.
However, the vulnerable implementation did not reliably distinguish between a trusted server-provided environment value and an identity value submitted directly by a remote client in an HTTP header.
The `WebserverAuthentication.get_user()` function first attempts to retrieve the configured `WEBSERVER_REMOTE_USER` value from the request environment. If that lookup fails, it falls back to retrieving the same name from incoming request headers.
Since HTTP request headers are controlled by the sender, an attacker who can access the pgAdmin instance could provide a header containing the username of a targeted account. This would let them authenticate as that account without a password, multi-factor authentication, or other valid credentials.
The risk was heightened when administrators configured `WEBSERVER_REMOTE_USER` with HTTP-prefixed or hyphenated values, such as `HTTP_X_FORWARDED_USER` or `X-Forwarded-User`.
WSGI servers often expose client-supplied headers in environment variables with such names, making the identity source potentially controlled by an attacker even before the fallback logic was applied.
Successful exploitation of this vulnerability could allow an attacker to gain access to a pgAdmin session belonging to an administrator or another privileged user. Once inside, the attacker could potentially view, alter, or delete database objects and data accessible through that account.
The vulnerability is rated Critical under both CVSS versions:
| Scoring system | Severity | Score |
|---|---|---|
| CVSS 3.1 | Critical | 9.8 |
| CVSS 4.0 | Critical | 9.3 |
The CVSS 3.1 vector indicates that exploitation can be conducted remotely with low attack complexity, requires no privileges or user interaction, and may result in significant impacts on confidentiality, integrity, and availability.
It is important to note that this issue applies only when the web server is enabled in pgAdmin’s `AUTHENTICATION_SOURCES` configuration. Organizations using other pgAdmin authentication mechanisms are not affected by this specific Webserver authentication flaw.
Version 9.18 changes how pgAdmin handles asserted identities. The update now differentiates between genuine CGI/WSGI variables and header-derived values, trusting only the former by default.
Administrators can still intentionally use a header-provided identity, but they must explicitly enable `WEBSERVER_REMOTE_USER_FROM_HEADER`.
This option should be combined with a trusted proxy configuration via `WEBSERVER_TRUSTED_PROXIES`. Deployments may also require a shared-secret header verified against `WEBSERVER_SHARED_SECRET`.
Additionally, the fix checks the actual socket peer address instead of relying on `request.remote_addr`, which could be manipulated through attacker-influenced `X-Forwarded-For` values. As an added safeguard, pgAdmin now blocks Webserver-authenticated logins to accounts whose `auth_source` is not set to webserver.
Organizations should upgrade immediately to pgAdmin 4.18, or the latest available patched release, and review their reverse-proxy authentication settings.
Security teams should ensure that identity headers are accepted only from explicitly trusted proxy addresses and investigate logs for unusual pgAdmin sessions, unauthorized administrator access, or unexpected header values. Security researcher Sanghyeon Lee, also known as h9e0n, reported the vulnerability.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/critical-pgadmin-authentication-bypass/