Executive Summary

This vulnerability exists in PgBouncer versions before 1.25.2 where the software did not properly check authorization for the KILL_CLIENT admin command.

As a result, any user who had access to the administration console—an area that itself requires authorization—could execute the KILL_CLIENT command.

The intended behavior was to restrict this command only to users specified in the admin_users parameter, but this check was missing or insufficient.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows any authorized user of the PgBouncer administration console to run the KILL_CLIENT command, which can terminate client connections.

This could lead to denial of service for legitimate clients by unexpectedly disconnecting them.

The CVSS score indicates a low to medium severity impact, primarily affecting availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade PgBouncer to version 1.25.2 or later where the authorization check for the KILL_CLIENT admin command is properly enforced.

Additionally, ensure that only trusted users have access to the administration console and that the admin_users parameter is correctly configured to restrict who can run administrative commands.

Useful 0 Not Useful 0