Do Son 
TL;DR
A flaw in pgAdmin 4 allows remote actors to bypass authentication when Webserver mode is active. Specifically, attackers can forge identity headers to log in as administrators without passwords. Therefore, organizations must deploy version 9.18 immediately to secure their database environments.
- CVE: CVE-2026-86863
- CVSS: 9.8 (Critical · CVSSv3)
- Product: pgadmin.org pgAdmin 4
- Affected: 6.2
- Impact: pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode
- Status: No confirmed exploitation yet
- Patched in: 9.18
- Action: Update to 9.18 now
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsWhy This Threat Matters
Sourced industry estimates indicate that millions of developers and administrators use pgAdmin to manage PostgreSQL deployments. Hence, vulnerabilities within this management portal expose mission-critical database clusters to severe danger. If an intruder exploits this pgAdmin 4 authentication bypass, they can execute arbitrary SQL queries. Furthermore, attackers can extract confidential records, tamper with tables, or destroy entire database schemas.
How the Attack Works
The security vulnerability resides in the application’s Webserver authentication module. This module should only accept identities delivered through the WSGI or CGI environment. However, the software improperly fell back to reading raw HTTP headers when environment variables were absent.
The advisory warns that “any client able to reach pgAdmin could supply that header itself.” Thus, attackers can log in as an administrator “without presenting a password or any other credential.” Consequently, an attacker sends an HTTP request containing a forged header like X-Forwarded-User. Currently, researchers have confirmed no active in-the-wild exploitation or public proof-of-concept for this flaw.
Affected Versions
This vulnerability impacts pgAdmin 4 releases from version 6.2 up to version 9.17. Additionally, the flaw only exposes deployments where operators have enabled webserver inside authentication settings.
Patch and Mitigation Steps
Administrators must update their installations to pgAdmin 4 version 9.18 without delay. The developers confirmed that “the fix distinguishes a genuine CGI/WSGI variable from a header-derived one.” You can review the complete technical discussion in the official pgAdmin issue tracker. Finally, administrators unable to patch immediately should disable Webserver authentication and use internal accounts.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
