CVE-2026-107350

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107350", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-07T19:13:32.963Z", "datePublished": "2026-10-14T17:34:39.009Z", "dateUpdated": "2026-10-16T14:18:50.053Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-10-14T17:34:39.009Z"}, "title": "Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer", "descriptions": [{"lang": "en", "value": "Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user."}], "affected": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"version": "1.17.0", "lessThan": "1.26.1", "versionType": "semver", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "type": "CWE", "description": "Improper Authentication"}]}], "references": [{"url": "https://www.pgbouncer.org/changelog.html"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "The attacker knows the password of a user that has its password stored in auth_file, and SCRAM authentication is used for both that user and the impersonated user (auth_type = scram-sha-256, auth_type = md5 with SCRAM secrets, or matching hba rules). The impersonated user can be loaded from either auth_file or auth_query."}], "credits": [{"lang": "en", "value": "Thanks to Dave Aitel (@daveaitel-openai, OpenAI) for finding and reporting this issue.", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107350", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T03:56:50.467564Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T14:18:50.053Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107350", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T03:56:50.467564Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T14:17:47.007Z"}}], "cna": {"title": "Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer", "credits": [{"lang": "en", "type": "finder", "value": "Thanks to Dave Aitel (@daveaitel-openai, OpenAI) for finding and reporting this issue."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "n/a", "product": "PgBouncer", "versions": [{"status": "affected", "version": "1.17.0", "lessThan": "1.26.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.pgbouncer.org/changelog.html"}], "descriptions": [{"lang": "en", "value": "Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "configurations": [{"lang": "en", "value": "The attacker knows the password of a user that has its password stored in auth_file, and SCRAM authentication is used for both that user and the impersonated user (auth_type = scram-sha-256, auth_type = md5 with SCRAM secrets, or matching hba rules). The impersonated user can be loaded from either auth_file or auth_query."}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-10-14T17:34:39.009Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107350", "state": "PUBLISHED", "dateUpdated": "2026-10-16T14:18:50.053Z", "dateReserved": "2026-10-07T19:13:32.963Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-10-14T17:34:39.009Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PgBouncer", "vendor": "n/a", "versions": [{"lessThan": "1.26.1", "status": "affected", "version": "1.17.0", "versionType": "semver"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user."}], "id": "CVE-2026-107350", "lastModified": "2026-10-16T15:17:04.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107350", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T03:56:50.467564Z", "version": "2.0.3"}}]}, "published": "2026-10-14T18:17:25.670", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.pgbouncer.org/changelog.html"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "pgbouncer: pgbouncer: Privilege escalation via secondary startup message during SCRAM authentication", "id": "2552733", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552733"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-841", "details": ["A flaw was found in PgBouncer. An improper authentication vulnerability allows a remote attacker possessing valid credentials for any listed user to impersonate any other user configured with Salted Challenge Response Authentication Mechanism (SCRAM), including PgBouncer administrators and backend superusers. By sending a second connection startup message targeted at a non-existent database during an active SCRAM exchange, the target identity is switched while authentication is verified against the initial user credentials. This issue enables an authenticated attacker to achieve privilege escalation and obtain unauthorized administrative access across the database environment."], "mitigation": {"lang": "en:us", "value": "Limit network access to the PgBouncer daemon so that only trusted application hosts can establish connections.\n1. Using firewalld, restrict traffic on the PgBouncer port (default 6432/tcp) to specific authorized client IP addresses:\n# firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_CLIENT_IP>\n# firewall-cmd --permanent --zone=trusted --add-port=6432/tcp\n# firewall-cmd --permanent --remove-port=6432/tcp --zone=public\n# firewall-cmd --reload\nAlternatively, if clients reside on the same host, bind PgBouncer exclusively to the loopback interface by configuring `listen_addr = 127.0.0.1` in `/etc/pgbouncer/pgbouncer.ini` and applying changes:\n# systemctl reload pgbouncer\nCaveats: Restricting network reachability prevents untrusted network hosts from connecting, but it does not protect against malicious or compromised clients residing within the permitted network range. Modifying firewall rules or reloading the PgBouncer service may briefly disrupt active client connections."}, "name": "CVE-2026-107350", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "pgbouncer", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-14T17:34:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107350\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107350\nhttps://www.pgbouncer.org/changelog.html"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.17.0,1.26.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PgBouncer", "source": "cna", "vendor": "n/a"}, "product": "pgbouncer", "vendor": "pgbouncer"}], "created": "2026-10-14T21:15:07.388557+00:00", "updated": "2026-10-17T07:15:04.757589+00:00", "vendors": ["pgbouncer", "pgbouncer$PRODUCT$pgbouncer"]}