CVE-2026-91924: pgweb Authentication Bypass Vulnerability

CVE-2026-91924 Overview

CVE-2026-91924 is a missing authorization vulnerability [CWE-862] in pgweb, a web-based PostgreSQL database browser, affecting versions through 0.17.0. The POST /api/connect endpoint remains unguarded when connect-backend authorization is configured. Attackers with low privileges can supply arbitrary database connection strings and bypass the resource-to-database mapping by providing a custom session identifier and connection URL. This grants access to unauthorized databases and internal services reachable from the pgweb host.

Critical Impact

Authenticated attackers can pivot to arbitrary PostgreSQL instances and internal services, exposing confidential data and enabling SSRF-style reconnaissance against backend networks.

Affected Products

• pgweb versions through 0.17.0
• Deployments using the connect-backend authorization mode
• Environments exposing pgweb to multi-tenant or untrusted users

Discovery Timeline

• 2026-09-15 - CVE-2026-91924 published to NVD
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91924

Vulnerability Analysis

pgweb supports a connect-backend mode that maps external resource identifiers to specific PostgreSQL connection strings. The intent is to restrict each authenticated session to a predefined database. The POST /api/connect route in pkg/api/routes.go handles direct connection requests but does not verify that the caller is limited to the mapped resource when connect-backend is active.

An attacker submitting a request to /api/connect can include a raw connection URL and an attacker-controlled session identifier. The handler in pkg/api/api.go accepts these values and establishes a database session outside the authorization scope. The result is a broken access control condition that undermines the entire multi-tenant model of the connect-backend deployment.

Root Cause

The root cause is missing authorization enforcement on a privileged endpoint. The connect-backend mode was designed to gate database access through server-side resource mapping, but the direct-connect handler was not updated to require that mapping. Client-supplied session IDs and URLs are trusted without checks against the configured backend policy.

Attack Vector

Exploitation requires network access to the pgweb HTTP interface and low-privileged authentication. An attacker sends a crafted POST /api/connect request containing an arbitrary url field pointing to a target PostgreSQL server, along with a chosen session identifier. pgweb opens the connection and returns a usable session, allowing the attacker to query internal databases, probe internal services on non-database ports, or exfiltrate data from tenants they should not reach. See the VulnCheck Advisory for the full technical write-up.

No verified public exploit code is available. Refer to the pgweb source in api.go and routes.go for the affected code paths.

Detection Methods for CVE-2026-91924

Indicators of Compromise

• Unexpected POST /api/connect requests in pgweb access logs, especially with attacker-supplied url parameters pointing to internal hostnames or non-standard PostgreSQL endpoints.
• New pgweb session identifiers that do not correspond to any resource defined in the connect-backend mapping.
• Outbound connections from the pgweb host to PostgreSQL instances or internal services outside the intended resource set.

Detection Strategies

• Parse pgweb HTTP logs and alert on any /api/connect request body containing a url field when connect-backend mode is enabled.
• Correlate pgweb process network telemetry with the authorized backend map; flag connections to unlisted destinations.
• Monitor PostgreSQL server logs for authentication attempts originating from the pgweb host to databases not part of the tenant configuration.

Monitoring Recommendations

• Enable verbose HTTP request logging on pgweb and forward logs to a centralized analytics platform.
• Baseline expected pgweb egress destinations and alert on deviations.
• Track session creation frequency per authenticated user to detect enumeration or lateral movement attempts.

How to Mitigate CVE-2026-91924

Immediate Actions Required

• Restrict network exposure of pgweb to trusted administrators until a patched release is deployed.
• Disable the connect-backend mode if it is not required, and rely on a fixed connection string configured server-side.
• Audit pgweb logs for prior use of POST /api/connect with client-supplied URLs and investigate any anomalous sessions.

Patch Information

At the time of publication, all pgweb releases through 0.17.0 are affected. Monitor the pgweb GitHub repository and GitHub Issue #869 for the fixed release, and upgrade as soon as a patched version is available.

Workarounds

• Place pgweb behind a reverse proxy that blocks or filters POST /api/connect requests when connect-backend mode is in use.
• Enforce network egress controls on the pgweb host so it can only reach the intended database backends.
• Require strong authentication and per-tenant network segmentation to limit blast radius until an upstream fix is applied.

# Example nginx snippet to block direct-connect abuse in connect-backend deployments
location = /api/connect {
    return 403;
}