CVE-2026-107350
8.8HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-287
Impact
An authenticated remote user can impersonate any other SCRAM-authenticated user, including PgBouncer admins and backend superusers. The attacker only needs network access and valid credentials for any single user in auth_file.
Root cause
PgBouncer fails to reject a second StartupMessage sent during SCRAM authentication against a non-existent database, switching the target username while validating credentials against the original user's keys.
Affected systems
PgBouncer 1.17.0 through 1.26.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade PgBouncer to a version above 1.26.0 (e.g., 1.26.1 or later per vendor changelog). If unable to patch immediately, restrict network access to the PgBouncer port to strictly trusted hosts and remove untrusted accounts from auth_file.
$ sudo apt-get update && sudo apt-get install --only-upgrade pgbouncerAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.