Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials
pgAdmin 4 versions 6.2-9.17 contain critical auth bypass CVE-2026-86863 (CVSS 9.8) letting unauthenticated attackers impersonate administrators; fixed in 9.18.
A critical authentication bypass (CVE-2026-86863, CVSS 3.1 score 9.8) affects pgAdmin 4 versions 6.2 through 9.17 when Webserver authentication is enabled in AUTHENTICATION_SOURCES. The WebserverAuthentication.get_user() function falls back to client-controlled HTTP headers such as X-Forwarded-User when the WEBSERVER_REMOTE_USER environment variable is absent, allowing unauthenticated remote attackers to log in as any user, including administrators, without a password or MFA. Successful attackers could view, alter, or delete PostgreSQL database objects and data accessible through the hijacked privileged session. Version 9.18 fixes the issue by trusting only genuine CGI/WSGI environment variables by default and requiring explicit options like WEBSERVER_REMOTE_USER_FROM_HEADER with trusted proxies for header-based identity.
- CVE-2026-86863 rated Critical: 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0); no privileges or user interaction needed.
- Only deployments using pgAdmin's Webserver authentication mode with header fallback are affected.
- Fix in 9.18 distinguishes trusted WSGI variables from headers and validates the socket peer address.
- Administrators urged to upgrade, restrict identity headers to trusted proxies, and audit logs for anomalous admin sessions.
- Flaw reported by researcher Sanghyeon Lee, also known as h9e0n.
- CVEs
- CVE-2026-86863
- Vendors
- pgAdminPostgreSQL
- Products
- pgAdmin 4
- Organizations
- EDB (EnterpriseDB)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86863 | Authentication Bypass via Client-Supplied Header Spoofing in pgAdmin 4 | 9.3 | — |
From the original article
3 min read at gbhackers.com
A critical vulnerability in pgAdmin 4 could allow unauthenticated remote attackers to impersonate arbitrary users, including existing administrator accounts, by supplying a malicious HTTP identity header. This vulnerability, tracked as CVE-2026-86863, affects installations using pgAdmin’s Webserver authentication mode and has a CVSS 3. 1 score of 9.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.