A critical authentication-bypass vulnerability in pgAdmin 4, tracked as CVE-2026-86863 and rated 9.8 (CVSSv3), allows remote attackers to access installations running Webserver authentication mode without a password or other credentials. The issue affects releases from version 6.2 through 9.17, but only where the webserver authentication option is enabled. An attacker who can reach the pgAdmin service could forge an identity header, such as `X-Forwarded-User`, and potentially gain administrator access.
That access could allow database queries and, consequently, the theft, alteration or deletion of data, although the article does not report any confirmed exploitation.
The flaw is in pgAdmin’s Webserver authentication module. It should accept identity information only from WSGI or CGI environment variables, but reportedly falls back to raw HTTP headers when those variables are missing. The developers fixed the problem in pgAdmin 4 version 9.18 by distinguishing genuine CGI/WSGI variables from values derived from request headers. Administrators should upgrade to 9.18; those unable to patch immediately are advised to disable Webserver authentication and use internal accounts.