CVE-2026-107350: Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Other sources
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.26.1-1 - Upgrade
Upgrade
debian/pgbouncerto a version that resolves this vulnerability.Fixed in 1.26.1-1
Event History
Frequently Asked Questions
Which deployments are exposed?
PgBouncer versions 1.17.0 through 1.26.0 are affected when a user is listed in auth_file and another target user authenticates using SCRAM. The target can include PgBouncer administrative users and backend superusers.
What does an attacker need to exploit this?
The attacker needs remote network access to PgBouncer and knowledge of the password for any user listed in auth_file. No user interaction is required, and the attacker can use that user's SCRAM verification exchange while switching the login identity to another SCRAM-authenticated user.
How does the authentication bypass work?
During SCRAM authentication, the attacker sends a second StartupMessage for a non-existent database. PgBouncer does not reject that message and changes the user being logged in as, while continuing to validate the SCRAM exchange using the first user's credentials.