CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user th…
Published Oct 14, 2026 · updated Oct 14, 2026
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · OSV.dev
Detected
Oct 14, 2026 · OSV.dev
Updated
The description or metadata changed.
Oct 14, 2026 · NIST NVD
Updated
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as,
Affected
- Debian:12 pgbouncer1.18.0-1, 1.18.0-1+deb12u1, 1.19.0-1
- Debian:13 pgbouncer1.24.1-1, 1.24.1-1+deb13u1, 1.24.1-1+deb13u2
- Debian:14 pgbouncer1.24.1-1, 1.25.0-1, 1.25.0-2
Sources
- CVE.orgCVE-2026-107350
Official CVE identifier
cve.org - NIST NVDCVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sen
nvd.nist.gov - OSV.devDEBIAN-CVE-2026-107350osv.dev