CVE-2026-86863 – pgAdmin 4
“When a single HTTP header can make a stranger your administrator, the front door is already open.”
This pgAdmin 4 update closes two serious flaws in the PostgreSQL management tool. CVE-2026-86863 has a CVSS score of 9.8, Critical severity. When webserver authentication is enabled, pgAdmin accepted a user identity from a client-supplied HTTP header. Any client that could reach pgAdmin could log in as any user, including an existing Administrator, with no password. The fix trusts a header identity only when the operator opts in and the request comes from a trusted proxy. A shared secret can also be required.
CVE-2026-86864 has a CVSS score of 8.8, High severity. Any authenticated user with the default backup permission could abuse the Backup tool's database field. That field let them write or overwrite files anywhere the pgAdmin process can write, including pgAdmin's own configuration database. The same field could also redirect the backup to an attacker's server, which sent the stored database password along with it. Both flaws allow privilege escalation, and both are fixed in pgAdmin 4 version 9.18.
Key Details
- Affected Product
- Pgadmin Pgadmin 4
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-290