Critical pgAdmin Flaw Lets Attackers Log In as Administrators

A critical authentication-bypass vulnerability in pgAdmin 4, tracked as CVE-2026-86863 and rated 9.8 (CVSSv3), affects releases from 6.2 through 9.17 when Webserver authentication is enabled. The flaw allows a remote user who can reach pgAdmin to forge an identity header, such as `X-Forwarded-User`, and log in as an administrator without a password or other credentials.

Successful access could enable an attacker to run SQL queries and potentially access, alter or delete data, although these consequences are described as possible impact rather than confirmed activity.

The issue is in the Webserver authentication module. It should accept identity information only from WSGI or CGI environment variables, but reportedly falls back to raw HTTP headers when those variables are unavailable. The supplied report says there is no confirmed exploitation in the wild and no public proof-of-concept. pgAdmin developers fixed the problem in version 9.18 by distinguishing genuine CGI/WSGI variables from values derived from HTTP headers.

Administrators should upgrade to pgAdmin 4 version 9.18; those unable to patch immediately are advised to disable Webserver authentication and use internal accounts instead.