p PatchFirst

CVE-2026-107350

CVE-2026-107350 · Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.

CVSS 8.8 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • pgbouncer

    Versions
    • ≥ 1.17.0, < 1.26.1: Affected (semver)

    Update to 1.26.1

  • pgbouncer Debian:12

    Versions
    • 1.18.0-1
    • 1.18.0-1+deb12u1
    • 1.19.0-1
    • 1.19.1-1
    • 1.20.0-1
    • 1.20.1-1
    • 1.21.0-1
    • 1.22.0-1
    • 1.22.1-1
    • 1.23.0-1
    • 1.23.1-1
    • 1.24.0-2
    • 1.24.0-3
    • 1.24.1-1
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.1-1
    • 1.25.2-1
    • 1.26.0-1
    • 1.26.0-2
    • 1.26.0-3
    • 1.26.0-4
    • 1.26.0-5
    • 1.26.0-6
    • 1.26.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Debian:13

    Versions
    • 1.24.1-1
    • 1.24.1-1+deb13u1
    • 1.24.1-1+deb13u2
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.1-1
    • 1.25.2-1
    • 1.26.0-1
    • 1.26.0-2
    • 1.26.0-3
    • 1.26.0-4
    • 1.26.0-5
    • 1.26.0-6
    • 1.26.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Debian:14

    Versions
    • 1.24.1-1
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.1-1
    • 1.25.2-1
    • 1.26.0-1
    • 1.26.0-2
    • 1.26.0-3
    • 1.26.0-4
    • 1.26.0-5
    • 1.26.0-6
    Affected ranges
    • ECOSYSTEM: < 1.26.1-1

    Update to 1.26.1-1

  • pgbouncer Ubuntu:16.04:LTS

    Versions
    • 1.5.5-1
    • 1.6.1-1
    • 1.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:18.04:LTS

    Versions
    • 1.7.2-3build1
    • 1.7.2-65-g2b8e6cf-1
    • 1.8.1-1
    • 1.8.1-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:20.04:LTS

    Versions
    • 1.10.0-1
    • 1.10.0-1build1
    • 1.11.0-1
    • 1.12.0-2
    • 1.12.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:22.04:LTS

    Versions
    • 1.15.0-1
    • 1.16.1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:24.04:LTS

    Versions
    • 1.20.0-1
    • 1.21.0-1
    • 1.22.0-1
    • 1.22.0-1build1
    • 1.22.0-1build3
    • 1.22.0-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:26.10

    Versions
    • 1.25.1-1
    • 1.25.2-1
    • 1.25.2-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgbouncer Ubuntu:26.04:LTS

    Versions
    • 1.24.1-1
    • 1.25.0-2
    • 1.25.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →