CVE-2026-107350
Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
- Record
CVE-2026-107350- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2026-101500
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
- Record
EUVD-2026-101500- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qcxp-3cx5-3f3g
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the...
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
- Record
GHSA-qcxp-3cx5-3f3g- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
- Record
CVE-2026-107350- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
- Record
DEBIAN-CVE-2026-107350- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:83843
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:83843- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
- Record
UBUNTU-CVE-2026-107350- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-108189 No score
CVE-2026-107350 affecting package pgbouncer for versions less than 1.26.1-1
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
- Record
AZL-108189- Updated
- 2026-11-02
OSVBIT-pgbouncer-2026-107350 No score
Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
- Record
BIT-pgbouncer-2026-107350- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pgbouncerAzure Linux:3 |
before 1.26.1-1 | 1.26.1-1 |
pgbouncerBitnami |
1.17.0 up to 1.26.1 | 1.26.1 |
pgbouncerDebian:12 |
All versions, plus listed versions 1.18.0-11.18.0-1+deb12u11.19.0-11.19.1-11.20.0-1 Show 20 moreShow less1.20.1-11.21.0-11.22.0-11.22.1-11.23.0-11.23.1-11.24.0-21.24.0-31.24.1-11.25.0-11.25.0-21.25.1-11.25.2-11.26.0-11.26.0-21.26.0-31.26.0-41.26.0-51.26.0-61.26.1-1 |
None known |
pgbouncerDebian:13 |
All versions, plus listed versions 1.24.1-11.24.1-1+deb13u11.24.1-1+deb13u21.25.0-11.25.0-2 Show 9 moreShow less1.25.1-11.25.2-11.26.0-11.26.0-21.26.0-31.26.0-41.26.0-51.26.0-61.26.1-1 |
None known |
pgbouncerDebian:14 |
before 1.26.1-1, plus listed versions 1.24.1-11.25.0-11.25.0-21.25.1-11.25.2-1 Show 6 moreShow less1.26.0-11.26.0-21.26.0-31.26.0-41.26.0-51.26.0-6 |
1.26.1-1 |
pgbouncerRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.26.1-1.hum1 | 0:1.26.1-1.hum1 |
pgbouncerUbuntu:16.04:LTS |
All versions, plus listed versions 1.5.5-11.6.1-11.7-1 |
None known |
pgbouncerUbuntu:18.04:LTS |
All versions, plus listed versions 1.7.2-3build11.7.2-65-g2b8e6cf-11.8.1-11.8.1-1build1 |
None known |
pgbouncerUbuntu:20.04:LTS |
All versions, plus listed versions 1.10.0-11.10.0-1build11.11.0-11.12.0-21.12.0-3 |
None known |
pgbouncerUbuntu:22.04:LTS |
All versions, plus listed versions 1.15.0-11.16.1-1ubuntu1 |
None known |
pgbouncerUbuntu:24.04:LTS |
All versions, plus listed versions 1.20.0-11.21.0-11.22.0-11.22.0-1build11.22.0-1build31.22.0-1build4 |
None known |
pgbouncerUbuntu:26.10 |
All versions, plus listed versions 1.25.1-11.25.2-11.25.2-1ubuntu1 |
None known |
pgbouncerUbuntu:26.04:LTS |
All versions, plus listed versions 1.24.1-11.25.0-21.25.1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107350 is a high vulnerability (CVSS 8.8) in pgbouncer, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in pgbouncer 1.26.1-1.
References
pgbouncer.org/changelog.html
nvd.nist.gov/vuln/detail/CVE-2026-107350
github.com/advisories/GHSA-qcxp-3cx5-3f3g
security-tracker.debian.org/tracker/CVE-2026-107350
access.redhat.com/errata/RHSA-2026:83843
images.redhat.com
Show 14 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83843.json
bugzilla.redhat.com/show_bug.cgi?id=2552741
cve.org/CVERecord?id=CVE-2026-107348
ubuntu.com/security/CVE-2026-107350