CVE-2026-6667: PgBouncer missing authorization check in KILL_CLIENT admin command
PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILLCLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the adminusers parameter.
Other sources
PgBouncer missing authorization check in KILLCLIENT admin command
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6667?
CVE-2026-6667 has been classified as a critical severity vulnerability due to the potential for unauthorized access to the KILL_CLIENT command.
How do I fix CVE-2026-6667?
To fix CVE-2026-6667, you should upgrade PgBouncer to version 1.25.2 or later, where the authorization check for KILL_CLIENT has been implemented.
Who is affected by CVE-2026-6667?
Any users of PgBouncer versions prior to 1.25.2 who have access to the administration console are affected by CVE-2026-6667.
What impact does CVE-2026-6667 have on system security?
CVE-2026-6667 could allow unauthorized users to terminate client connections, compromising the stability and security of the database environment.
Is CVE-2026-6667 a known issue in earlier PgBouncer versions?
Yes, CVE-2026-6667 is a known issue in all versions of PgBouncer prior to 1.25.2, where proper authorization for the KILL_CLIENT command was not enforced.