Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials

A critical vulnerability in pgAdmin 4 could allow unauthenticated remote attackers to impersonate arbitrary users, including existing administrator accounts, by supplying a malicious HTTP identity header.

This vulnerability, tracked as CVE-2026-86863, affects installations using pgAdmin’s Webserver authentication mode and has a CVSS 3.1 score of 9.8 out of 10.

The issue impacts pgAdmin 4 versions 6.2 through 9.17 and has been addressed in pgAdmin 4 version 9.18.

Critical pgAdmin Authentication Bypass

pgAdmin’s Webserver authentication source is intended for deployments where an upstream web server or reverse proxy authenticates a user before forwarding requests to pgAdmin. The upstream component provides the authenticated username through a CGI or WSGI environment variable.

However, the vulnerable implementation did not reliably distinguish between a trusted server-provided environment value and an identity value submitted directly by a remote client in an HTTP header.

The `WebserverAuthentication.get_user()` function first attempts to retrieve the configured `WEBSERVER_REMOTE_USER` value from the request environment. If that lookup fails, it falls back to retrieving the same name from incoming request headers.

Since HTTP request headers are controlled by the sender, an attacker who can access the pgAdmin instance could provide a header containing the username of a targeted account. This would let them authenticate as that account without a password, multi-factor authentication, or other valid credentials.

The risk was heightened when administrators configured `WEBSERVER_REMOTE_USER` with HTTP-prefixed or hyphenated values, such as `HTTP_X_FORWARDED_USER` or `X-Forwarded-User`.

WSGI servers often expose client-supplied headers in environment variables with such names, making the identity source potentially controlled by an attacker even before the fallback logic was applied.

Successful exploitation of this vulnerability could allow an attacker to gain access to a pgAdmin session belonging to an administrator or another privileged user. Once inside, the attacker could potentially view, alter, or delete database objects and data accessible through that account.

The vulnerability is rated Critical under both CVSS versions:

Scoring system	Severity	Score
CVSS 3.1	Critical	9.8
CVSS 4.0	Critical	9.3

The CVSS 3.1 vector indicates that exploitation can be conducted remotely with low attack complexity, requires no privileges or user interaction, and may result in significant impacts on confidentiality, integrity, and availability.

It is important to note that this issue applies only when the web server is enabled in pgAdmin’s `AUTHENTICATION_SOURCES` configuration. Organizations using other pgAdmin authentication mechanisms are not affected by this specific Webserver authentication flaw.

Version 9.18 changes how pgAdmin handles asserted identities. The update now differentiates between genuine CGI/WSGI variables and header-derived values, trusting only the former by default.

Administrators can still intentionally use a header-provided identity, but they must explicitly enable `WEBSERVER_REMOTE_USER_FROM_HEADER`.

This option should be combined with a trusted proxy configuration via `WEBSERVER_TRUSTED_PROXIES`. Deployments may also require a shared-secret header verified against `WEBSERVER_SHARED_SECRET`.

Additionally, the fix checks the actual socket peer address instead of relying on `request.remote_addr`, which could be manipulated through attacker-influenced `X-Forwarded-For` values. As an added safeguard, pgAdmin now blocks Webserver-authenticated logins to accounts whose `auth_source` is not set to webserver.

Organizations should upgrade immediately to pgAdmin 4.18, or the latest available patched release, and review their reverse-proxy authentication settings.

Security teams should ensure that identity headers are accepted only from explicitly trusted proxy addresses and investigate logs for unusual pgAdmin sessions, unauthorized administrator access, or unexpected header values. Security researcher Sanghyeon Lee, also known as h9e0n, reported the vulnerability.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC