Description
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
Published: 2026-10-14
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch Now
AI Analysis

Impact

PgBouncer versions 1.17.0 through 1.26.0 contain an authentication flaw (CWE-287) that allows a remote attacker who knows a valid password for any user in the auth_file to log in as any other user, including administrators and backend superusers. The attacker can send a second StartupMessage during an ongoing SCRAM exchange, targeting a non-existent database. This message is not rejected and changes the authenticated user while the first SCRAM verification remains intact, thereby bypassing normal authentication checks.

Affected Systems

The vulnerability affects PgBouncer releases from 1.17.0 up to 1.26.0. Any deployment of these versions that relies on SCRAM authentication with a populated auth_file is impacted.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity, and the exploit is feasible remotely for an attacker who can obtain a valid user password. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog, but the significant CVSS rating and the ease of exploiting an authentication bypass suggest a high risk of unauthorized access.

Generated by OpenCVE AI on October 15, 2026 at 14:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade PgBouncer to version 1.27.0 or later, the first release that fixes the SCRAM authentication flaw.
  • If possible, limit the auth_file to exclude privileged users and remove unnecessary superuser accounts.
  • Implement network access controls so that only trusted hosts can reach the PgBouncer instance.

Generated by OpenCVE AI on October 15, 2026 at 14:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Pgbouncer
Pgbouncer pgbouncer
Vendors & Products Pgbouncer
Pgbouncer pgbouncer

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-841
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 14 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
Title Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Pgbouncer Pgbouncer
cve-icon MITRE

Status: PUBLISHED

Assigner: PostgreSQL

Published:

Updated: 2026-10-16T14:18:50.053Z

Reserved: 2026-10-07T19:13:32.963Z

Link: CVE-2026-107350

cve-icon Vulnrichment

Updated: 2026-10-16T14:17:47.007Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T18:17:25.670

Modified: 2026-10-16T15:17:04.897

Link: CVE-2026-107350

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-14T17:34:39Z

Links: CVE-2026-107350 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T07:15:04Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-841

    Improper Enforcement of Behavioral Workflow