CVE-2026-107350

8.8 Élevée

Publiée le 14/10/2026 à 20:17 · Modifiée le 16/10/2026 à 17:17 · En attente d'analyse NVD · Source : f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Description

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.

Traduire en français

Produits concernés

PgBouncer

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	f86ef6dc-4d3a-42ad-8f28-e6d5547a5007	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-287

Références

https://www.pgbouncer.org/changelog.html

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories