CVE-2026-107350

Awaiting Analysis Awaiting Analysis - Queue

Improper Authentication in PgBouncer via SCRAM Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: PostgreSQL

Description

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107350

EUVD

EUVD-2026-101500

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	PgBouncer	1.17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authentication issue in PgBouncer versions 1.17.0 through 1.26.0. A remote attacker who knows a user's password can log in as any other user that uses SCRAM authentication, including admin users and backend superusers. This happens because a second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in, while the SCRAM exchange is still verified against the first user's keys.

Detection Guidance

To detect this vulnerability, check if your PgBouncer version is between 1.17.0 and 1.26.0. Verify if SCRAM authentication is enabled and review authentication logs for unusual login attempts or multiple StartupMessage exchanges during authentication.

Impact Analysis

This vulnerability allows an attacker to gain unauthorized access to sensitive data or administrative functions by impersonating legitimate users. If exploited, it could lead to data breaches, unauthorized modifications, or complete system compromise depending on the privileges of the impersonated user.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. Organizations using affected PgBouncer versions may face legal penalties, reputational damage, and increased scrutiny due to potential data exposure.

Mitigation Strategies

Upgrade PgBouncer to a version later than 1.26.0 where this vulnerability is patched.

Hi! I’m here to help you understand CVE-2026-107350. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70