Executive brief
pgAdmin 4 is a web-based database administration tool. When configured to use webserver authentication (a method to delegate user identity verification to a reverse proxy or web server), an attacker able to reach pgAdmin could bypass authentication by forging HTTP headers, potentially gaining Administrator access without a password. This affects deployments that use webserver authentication mode and rely on it as a security boundary.
Technical details
The vulnerability is an authentication bypass in pgAdmin 4's webserver authentication source. The WebserverAuthentication.get_user() method attempted to read the authenticated identity from WSGI/CGI environment variables (config.WEBSERVER_REMOTE_USER), but fell back to reading the same variable name directly from HTTP request headers when not found in the environment. Since HTTP request headers are client-controlled, an attacker could supply a forged header to assert any identity, including Administrator accounts. Additionally, certain environment variable names (HTTP_-prefixed or hyphenated) could be populated by inbound headers in WSGI, further lowering the attack bar. The fix requires explicit opt-in for header-based identity (WEBSERVER_REMOTE_USER_FROM_HEADER), validates that the request originates from a trusted proxy (WEBSERVER_TRUSTED_PROXIES), optionally checks a shared secret (WEBSERVER_SHARED_SECRET_HEADER), and adds defensive checks to reject accounts not tagged with 'webserver' auth_source. This vulnerability affects pgAdmin 4 versions 6.2 through 9.17 when webserver authentication is enabled.
Affected products
- pgAdmin pgAdmin 4 6.2 to 9.17
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fix available in pgAdmin 4 9.18 and later