CVE-2026-86863: CWE-290 Authentication Bypass by Spoofing in pgadmin.org pgAdmin 4
pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.get_user() read config.WEBSERVER_REMOTE_USER from request.environ and, when that returned nothing, fell back to reading the same name directly from the inbound HTTP request headers via request.headers.get(). An inbound HTTP header is written by whoever sends the request, so any client able to reach pgAdmin could supply that header itself and be authenticated as any username it named, including an existing Administrator, without presenting a password or any other credential. The environment lookup could also be satisfied by a client-supplied header whenever WEBSERVER_REMOTE_USER was configured to an HTTP_-prefixed or hyphenated name such as HTTP_X_FORWARDED_USER or X-Forwarded-User, since WSGI servers place inbound headers into the environment under exactly those names. Deployments are affected only when 'webserver' is enabled in AUTHENTICATION_SOURCES. The fix distinguishes a genuine CGI/WSGI variable from a header-derived one and implicitly trusts only the former. A header-asserted identity is now accepted only when the operator explicitly opts in via WEBSERVER_REMOTE_USER_FROM_HEADER, the request arrives from a peer listed in WEBSERVER_TRUSTED_PROXIES, and, when configured, a shared secret supplied in WEBSERVER_SHARED_SECRET_HEADER matches WEBSERVER_SHARED_SECRET under a constant-time comparison. The trusted-peer check deliberately reads the real socket peer address rather than request.remote_addr, because ProxyFix rewrites the latter from the client-controlled X-Forwarded-For header and would otherwise allow an attacker to claim to be the trusted proxy. As defence in depth, login() now refuses any account whose auth_source is not 'webserver', so a misconfigured trust gate cannot be used to assume an internal or LDAP account. This issue affects pgAdmin 4: from 6.2 before 9.18.
AI Analysis
Technical Summary
pgAdmin 4's Webserver authentication source improperly trusts HTTP headers for user identity assertion. The method WebserverAuthentication.get_user() reads the username from the WSGI/CGI environment or falls back to HTTP headers if the environment variable is empty. Since HTTP headers can be controlled by any client, this allows an attacker to supply arbitrary usernames, including administrators, bypassing authentication entirely. The vulnerability affects deployments with 'webserver' enabled in AUTHENTICATION_SOURCES. The fix enforces that only genuine CGI/WSGI environment variables are trusted by default. Header-based identity assertion is allowed only if explicitly enabled via WEBSERVER_REMOTE_USER_FROM_HEADER, the request comes from a trusted proxy listed in WEBSERVER_TRUSTED_PROXIES, and a shared secret header matches a configured secret. Additional protections include verifying the real socket peer address and refusing login for accounts not using 'webserver' auth_source to prevent misuse of the trust gate. This vulnerability affects pgAdmin 4 versions >=6.2 and <9.18.
Potential Impact
An unauthenticated attacker able to reach the pgAdmin 4 webserver can bypass authentication by spoofing HTTP headers to impersonate any user, including administrators. This leads to full compromise of the pgAdmin 4 interface, allowing unauthorized access and control over database management functions. The vulnerability has a CVSS 3.1 score of 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in pgAdmin 4 version 9.18 and later. Operators should upgrade to version 9.18 or newer to remediate this vulnerability. The fix restricts trust to genuine CGI/WSGI environment variables and requires explicit configuration for header-based authentication, including trusted proxies and shared secrets. Until upgraded, deployments should disable 'webserver' authentication or ensure that WEBSERVER_REMOTE_USER_FROM_HEADER is not enabled and that untrusted clients cannot reach the pgAdmin webserver. Review and apply vendor guidance from pgAdmin.org for secure configuration.
CVE-2026-86863: CWE-290 Authentication Bypass by Spoofing in pgadmin.org pgAdmin 4
Description
pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.get_user() read config.WEBSERVER_REMOTE_USER from request.environ and, when that returned nothing, fell back to reading the same name directly from the inbound HTTP request headers via request.headers.get(). An inbound HTTP header is written by whoever sends the request, so any client able to reach pgAdmin could supply that header itself and be authenticated as any username it named, including an existing Administrator, without presenting a password or any other credential. The environment lookup could also be satisfied by a client-supplied header whenever WEBSERVER_REMOTE_USER was configured to an HTTP_-prefixed or hyphenated name such as HTTP_X_FORWARDED_USER or X-Forwarded-User, since WSGI servers place inbound headers into the environment under exactly those names. Deployments are affected only when 'webserver' is enabled in AUTHENTICATION_SOURCES. The fix distinguishes a genuine CGI/WSGI variable from a header-derived one and implicitly trusts only the former. A header-asserted identity is now accepted only when the operator explicitly opts in via WEBSERVER_REMOTE_USER_FROM_HEADER, the request arrives from a peer listed in WEBSERVER_TRUSTED_PROXIES, and, when configured, a shared secret supplied in WEBSERVER_SHARED_SECRET_HEADER matches WEBSERVER_SHARED_SECRET under a constant-time comparison. The trusted-peer check deliberately reads the real socket peer address rather than request.remote_addr, because ProxyFix rewrites the latter from the client-controlled X-Forwarded-For header and would otherwise allow an attacker to claim to be the trusted proxy. As defence in depth, login() now refuses any account whose auth_source is not 'webserver', so a misconfigured trust gate cannot be used to assume an internal or LDAP account. This issue affects pgAdmin 4: from 6.2 before 9.18.
CVSS v3.1
Score 9.8critical
Affected software
pgadmin.org
pgAdmin 4
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
pgAdmin 4's Webserver authentication source improperly trusts HTTP headers for user identity assertion. The method WebserverAuthentication.get_user() reads the username from the WSGI/CGI environment or falls back to HTTP headers if the environment variable is empty. Since HTTP headers can be controlled by any client, this allows an attacker to supply arbitrary usernames, including administrators, bypassing authentication entirely. The vulnerability affects deployments with 'webserver' enabled in AUTHENTICATION_SOURCES. The fix enforces that only genuine CGI/WSGI environment variables are trusted by default. Header-based identity assertion is allowed only if explicitly enabled via WEBSERVER_REMOTE_USER_FROM_HEADER, the request comes from a trusted proxy listed in WEBSERVER_TRUSTED_PROXIES, and a shared secret header matches a configured secret. Additional protections include verifying the real socket peer address and refusing login for accounts not using 'webserver' auth_source to prevent misuse of the trust gate. This vulnerability affects pgAdmin 4 versions >=6.2 and <9.18.
Potential Impact
An unauthenticated attacker able to reach the pgAdmin 4 webserver can bypass authentication by spoofing HTTP headers to impersonate any user, including administrators. This leads to full compromise of the pgAdmin 4 interface, allowing unauthorized access and control over database management functions. The vulnerability has a CVSS 3.1 score of 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in pgAdmin 4 version 9.18 and later. Operators should upgrade to version 9.18 or newer to remediate this vulnerability. The fix restricts trust to genuine CGI/WSGI environment variables and requires explicit configuration for header-based authentication, including trusted proxies and shared secrets. Until upgraded, deployments should disable 'webserver' authentication or ensure that WEBSERVER_REMOTE_USER_FROM_HEADER is not enabled and that untrusted clients cannot reach the pgAdmin webserver. Review and apply vendor guidance from pgAdmin.org for secure configuration.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-09-08T15:47:05.445Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aac0b8155bf5e2cf5942eed
Added to database: 09/17/2026, 15:47:13 UTC
Last enriched: 09/17/2026, 16:01:35 UTC
Last updated: 09/17/2026, 17:12:24 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.