CVE-2026-86863

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

CVE-2026-86863 pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

CVE-2026-86863 pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

CVE-2026-86863

pgAdmin 4 (versions 6.2 through 9.17 ) has an authentication bypass in its Webserver authentication mode. The WebserverAuthentication.get_user() method fell back to reading the WEBSERVER_REMOTE_USER value directly from inbound HTTP request headers, allowing any client to assert an arbitrary ident...