8.8
High
CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user…
Description
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| pgbouncer 1.17 | 1.17.0 → < 1.26.1 | 1.26.1 |
References
- www.pgbouncer.org www.pgbouncer.org
Timeline
- Published
- Last modified
Other CVEs of pgbouncer
The 13 CVEs of pgbouncer →
CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of…
7.5
High
CVE-2026-107348
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a…
5.9
Medium
CVE-2026-19888
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2…
7.5
High
CVE-2026-6668
Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker…
7.5
High