CVE-2026-86863Patch(pgadmin / pgadmin_4)

MEDIUMCVSS 9.3 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch pgadmin pgadmin_4 systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.get_user() read config.WEBSERVER_REMOTE_USER from request.environ and, when that returned nothing, fell back to reading the same name directly from the inbound HTTP request headers via request.headers.get(). An inbound HTTP header is written by whoever sends the request, so any client able to reach pgAdmin could supply that header itself and be authenticated as any username it named, including an existing Administrator, without presenting a password or any other credential. The environment lookup could also be satisfied by a client-supplied header whenever WEBSERVER_REMOTE_USER was configured to an HTTP_-prefixed or hyphenated name such as HTTP_X_FORWARDED_USER or X-Forwarded-User, since WSGI servers place inbound headers into the environment under exactly those names. Deployments are affected only when 'webserver' is enabled in AUTHENTICATION_SOURCES. The fix distinguishes a genuine CGI/WSGI variable from a header-derived one and implicitly trusts only the former. A header-asserted identity is now accepted only when the operator explicitly opts in via WEBSERVER_REMOTE_USER_FROM_HEADER, the request arrives from a peer listed in WEBSERVER_TRUSTED_PROXIES, and, when configured, a shared secret supplied in WEBSERVER_SHARED_SECRET_HEADER matches WEBSERVER_SHARED_SECRET under a constant-time comparison. The trusted-peer check deliberately reads the real socket peer address rather than request.remote_addr, because ProxyFix rewrites the latter from the client-controlled X-Forwarded-For header and would otherwise allow an attacker to claim to be the trusted proxy. As defence in depth, login() now refuses any account whose auth_source is not 'webserver', so a misconfigured trust gate cannot be used to assume an internal or LDAP account. This issue affects pgAdmin 4: from 6.2 before 9.18.

pgadmin CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/pgadmin-org/pgadmin4/issues/10383

Weakness type (CWE)

CWE-290CWE-807

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

pgadmin_4

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
8 mentions across 4 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 6 signals
Technical details provided in 8 signals
Disclosure: 2 classified signals
Peaked 3d ago at 3 mentions (2026-09-18); latest day: 1
8 total mentions across 4 days

Affected systems

Vendors

pgadmin

Products

pgadmin_4

Deep dive

Activity timeline8 mentions / 4d

Signal classification3 categories

Patch

562.5%

Disclosure

225.0%

Active Exploitation

112.5%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-18	3	Patch3
2026-09-21	2	Disclosure2
2026-09-24	2	Active Exploitation1Patch1
2026-09-28	1	Patch1

Full discourse8 posts

Daily CyberSecurity@Daily_CyberSec46d
Patch
A critical pgAdmin 4 authentication bypass (CVE-2026-86863) allows remote admin takeover. Patch this pgAdmin 4 authentication bypass vulnerability now. #pgAdmin #PostgreSQL #CVE202686863 #AuthenticationBypass #Cybersecurity https://securityonline.info/pgadmin-4-authentication-bypass-cve-2026-86863/
Post summary
The text discloses a critical pgAdmin 4 authentication bypass (CVE-2026-86863) enabling remote admin takeover and includes an explicit call to patch, but provides no PoC, exploit tools, or active exploitation evidence.
180235888
13.0K followersView on X
CCB Alert@CCBalert42d
Disclosure
Warning: Critical Authentication Bypass vulnerability in #pgAdmin 4 webserver. CVE-2026-86863 CVSS:9.8. Successful exploitation leads to complete compromise of the pgAdmin 4 interface, resulting to unauthorized access and control over database management functions. #Patch
Post summary
The text discloses a critical authentication bypass vulnerability in pgAdmin 4 (CVE-2026-86863) with a CVSS score of 9.8, emphasizing its potential for unauthorized database access. While no specific patch or PoC is named, the inclusion of the #Patch hashtag suggests urgency for remediation.
11000288
7.3K followersView on X
NEXSIGHT@NEXSIGHTNEWS45d
Patch
PostgreSQL管理ツール「pgAdmin 4」のv9.18が4件の脆弱性を修正 — Webserver認証モードでは、pgAdminに到達できる任意のクライアントが管理者を含む任意の利用者になりすませた https://cyber.nexsight.co/articles/2026/09/18/pgadmin4-v9-18-authentication-bypass-cve-2026-86863-2026-09-18/
Post summary
News snippet announcing pgAdmin 4 v9.18 fixing 4 vulnerabilities including an authentication bypass (CVE-2026-86863) in Webserver mode; a fixed version is named, but no PoC, exploit tool, or active exploitation is cited in the text.
1000055
74 followersView on X
VulnTracker@vuln_tracker45d
Patch
A single HTTP header can log you into pgAdmin 4 as Administrator no password required (CVSS 9.8). CVE-2026-86863 affects pgAdmin's Webserver authentication mode, which trusts a client-controlled identity header instead of verifying it came from a real proxy. Anyone who can reach the app can authenticate as any username they choose. Affects pgAdmin 4 from 6.2 before 9.18. The fix adds an explicit opt-in, a trusted-proxy check, and a shared secret. Details: http://vulntracker.io/cves/CVE-2026-86863 #pgAdmin #CVE #PostgreSQL #InfoSec #CyberSecurity
Post summary
The text discloses CVE-2026-86863, a critical authentication bypass in pgAdmin 4 (CVSS 9.8) allowing unauthenticated admin login via a manipulated HTTP header, and identifies the fix available in version 9.18 which adds trusted-proxy validation and a shared secret.
00001141
765 followersView on X
iototsecnews@iototsecnews36d
Patch
pgAdmin の脆弱性 CVE-2026-86863 が FIX：管理者アカウントへの不正アクセスの恐れ https://iototsecnews.jp/2026/09/18/critical-pgadmin-authentication-bypass-lets-attackers-login-as-administrator-without-credentials/ pgAdmin 4 (v6.2-9.17) の Webserver 認証環境において、HTTP ヘッダーを介した認証迂回の深刻な脆弱性 CVE-2026-86863 が存在します。上流サーバ由来の環境変数とクライアント送付のヘッダーを誤区別する実装不備により、リモート攻撃者にパスワードなしで管理者等の権限を奪取され、データベース内データの閲覧／変更／削除に至る恐れがあります。安全確保のために pgAdmin 4 v9.18 への速やかな更新／リバースプロキシ設定の見直し／アクセスログの点検が求められます。 #CVE202686861 #CVE202686862 #CVE202686863 #CVE202686864 #pgAdmin #Vulnerability
Post summary
The post announces a fix for CVE-2026-86863, an authentication bypass in pgAdmin, and urges users to upgrade to version 9.18 or adjust proxy settings.
00000119
517 followersView on X
sunil kumawat@Sunil_kumawat1739d
Active Exploitation
@CCBalert CVE-2026-86863 (pgAdmin 6.2–9.17): with `webserver` in AUTHENTICATION_SOURCES, get_user() could fall back to a client-controlled identity header → unauth admin impersonation. Fix 9.18. If you can’t patch yet, remove `webserver` from AUTHENTICATION_SOURCES.
Post summary
The post flags CVE-2026-86863 as an active exploitation event per CCBalert, detailing the pgAdmin identity header flaw and advising users to apply Fix 9.18 or remove the webserver authentication source.
0000019
23 followersView on X
sunil kumawat@Sunil_kumawat1739d
Patch
@NEXSIGHTNEWS CVE-2026-86863 (pgAdmin 6.2–9.17): with `webserver` in AUTHENTICATION_SOURCES, get_user() could fall back to a client-controlled identity header → unauth admin impersonation. Fix 9.18. If you can’t patch yet, remove `webserver` from AUTHENTICATION_SOURCES.
Post summary
The tweet announces a vulnerability in pgAdmin that could allow unauthenticated admin impersonation, and provides a fix in version 9.18 along with a workaround.
0000020
23 followersView on X
Cybersecurity News DE@cybsecuritynews42d
Disclosure
#schwachstellen Kritische Schwachstelle in pgAdmin 4 erlaubt Anmeldung als Administrator ohne Passwort #cve202686863 #pgadmin4 #postgresql #webserverauthentifizierung https://cybersecurity-news.de/cve-2026-86863-pgadmin-4-anmeldung-ohne-passwort
Post summary
The text announces a critical pgAdmin 4 authentication bypass allowing passwordless admin login and links to a news article, but provides no patch, exploit, or active exploitation details.
0000044
13 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	pgadmin	pgadmin_4	-	postgresql	-

Explore more

Back to dashboard pgadmin CVEs pgadmin_4 vulnerabilities

What researchers are saying

CVE-2026-86863

VulnTracker[verified]@vuln_trackerPatch

The text discloses CVE-2026-86863, a critical authentication bypass in pgAdmin 4 (CVSS 9.8) allowing unauthenticated admin login via a manipulated HTTP header, and identifies the fix available in version 9.18 which adds trusted-proxy validation and a shared secret.

Daily CyberSecurity@Daily_CyberSecPatch

The text discloses a critical pgAdmin 4 authentication bypass (CVE-2026-86863) enabling remote admin takeover and includes an explicit call to patch, but provides no PoC, exploit tools, or active exploitation evidence.

CCB Alert@CCBalertDisclosure

The text discloses a critical authentication bypass vulnerability in pgAdmin 4 (CVE-2026-86863) with a CVSS score of 9.8, emphasizing its potential for unauthorized database access. While no specific patch or PoC is named, the inclusion of the #Patch hashtag suggests urgency for remediation.

NEXSIGHT@NEXSIGHTNEWSPatch

News snippet announcing pgAdmin 4 v9.18 fixing 4 vulnerabilities including an authentication bypass (CVE-2026-86863) in Webserver mode; a fixed version is named, but no PoC, exploit tool, or active exploitation is cited in the text.

iototsecnews@iototsecnewsPatch

The post announces a fix for CVE-2026-86863, an authentication bypass in pgAdmin, and urges users to upgrade to version 9.18 or adjust proxy settings.

sunil kumawat@Sunil_kumawat17Active Exploitation

The post flags CVE-2026-86863 as an active exploitation event per CCBalert, detailing the pgAdmin identity header flaw and advising users to apply Fix 9.18 or remove the webserver authentication source.

sunil kumawat@Sunil_kumawat17Patch

The tweet announces a vulnerability in pgAdmin that could allow unauthenticated admin impersonation, and provides a fix in version 9.18 along with a workaround.

Cybersecurity News DE@cybsecuritynewsDisclosure

The text announces a critical pgAdmin 4 authentication bypass allowing passwordless admin login and links to a news article, but provides no patch, exploit, or active exploitation details.