CVE-2026-86862

A flaw was found in pgAdmin 4. Authenticated users with toolsrestore or toolsmaintenance permissions can exploit a connection-string injection issue in the Restore and Maintenance tools. By manipulating the 'database' field passed to the --dbname option of pgrestore and psql, an attacker can...

CVE-2026-86863

A flaw was found in pgAdmin 4. When the 'webserver' authentication source is enabled, a remote attacker can bypass authentication by supplying a client-controlled identity header. This allows the attacker to authenticate as any user, including an Administrator, without providing valid credentials...

CVE-2026-86864

A flaw was found in pgAdmin 4. An authenticated user with 'toolsbackup' permission can exploit an argument injection vulnerability in the Backup tool to create or overwrite arbitrary files on the system where pgAdmin is running. Additionally, a connection-string injection vulnerability allows the...

CVE-2026-86864

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

CVE-2026-86862

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

CVE-2026-86863

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

EUVD-2026-81896

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

CVE-2026-86864 pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

CVE-2026-86864 pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

CVE-2026-86864 pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

CVE-2026-86864

pgAdmin 4 (Backup tool) is vulnerable to argument and connection-string injection via the client-supplied database field. Because the value was appended as a bare trailing positional argument to pg_dump, a dash-prefixed value (e.g. --file=/abs/path) was interpreted as an option due to getopt_long...

CVE-2026-86863 pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

CVE-2026-86863 pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

CVE-2026-86863 pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

CVE-2026-86863

pgAdmin 4 (versions 6.2 through 9.17 ) has an authentication bypass in its Webserver authentication mode. The WebserverAuthentication.get_user() method fell back to reading the WEBSERVER_REMOTE_USER value directly from inbound HTTP request headers, allowing any client to assert an arbitrary ident...

EUVD-2026-81895

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

CVE-2026-86862 pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

CVE-2026-86862 pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

CVE-2026-86862

pgAdmin 4 's Restore and Maintenance tools were vulnerable to connection-string injection through the database field, passed directly as --dbname to pg_restore/psql. Because libpq expands a database name containing = into a full connection string, an attacker-supplied value like host=attacker.exa...

EUVD-2026-81694

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...