Is CVE-2026-86863 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86863 being exploited in the wild.

How severe is CVE-2026-86863?

Critical severity, with a CVSS score of 9.8, published 17 September 2026.

Is there a fix for CVE-2026-86863?

A patch was published on 2026-09-17: Fix available in pgAdmin 4 9.18 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86863 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86863?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86863: pgAdmin 4 authentication bypass in webserver mode

CVE-2026-86863 · Severity: critical · CVSS 9.8 · Published 2026-09-17

pgAdmin 4 is a web-based database administration tool. When configured to use webserver authentication (a method to delegate user identity verification to a reverse proxy or web server), an attacker able to reach pgAdmin could bypass authentication by forging HTTP headers, potentially gaining Administrator access without a password. This affects deployments that use webserver authentication mode and rely on it as a security boundary.

Quick answers

Is CVE-2026-86863 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86863 being exploited in the wild.
How severe is CVE-2026-86863?: Critical severity, with a CVSS score of 9.8, published 17 September 2026.
Which products and versions are affected?: pgAdmin pgAdmin 4 6.2 to 9.17.
Is there a fix for CVE-2026-86863?: A patch was published on 2026-09-17: Fix available in pgAdmin 4 9.18 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86863 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86863?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in pgAdmin 4's webserver authentication source. The WebserverAuthentication.get_user() method attempted to read the authenticated identity from WSGI/CGI environment variables (config.WEBSERVER_REMOTE_USER), but fell back to reading the same variable name directly from HTTP request headers when not found in the environment. Since HTTP request headers are client-controlled, an attacker could supply a forged header to assert any identity, including Administrator accounts. Additionally, certain environment variable names (HTTP_-prefixed or hyphenated) could be populated by inbound headers in WSGI, further lowering the attack bar. The fix requires explicit opt-in for header-based identity (WEBSERVER_REMOTE_USER_FROM_HEADER), validates that the request originates from a trusted proxy (WEBSERVER_TRUSTED_PROXIES), optionally checks a shared secret (WEBSERVER_SHARED_SECRET_HEADER), and adds defensive checks to reject accounts not tagged with 'webserver' auth_source. This vulnerability affects pgAdmin 4 versions 6.2 through 9.17 when webserver authentication is enabled.

Affected products

pgAdmin pgAdmin 4 6.2 to 9.17

Timeline

2026-09-17: disclosed
2026-09-17: patched: Fix available in pgAdmin 4 9.18 and later

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.