CVE-2026-107350 PgBouncer CVE debrief

Who should care

Database administrators, security teams, and developers using PgBouncer should assess exposure and prioritize remediation due to the high CVSS score of 8.8 and potential for unauthorized access.

Why it matters

CVE-2026-107350 is a high-severity vulnerability in PgBouncer that allows remote attackers to bypass authentication and log in as other users. Database administrators and security teams should prioritize remediation and verify current configurations to prevent potential unauthorized access and privilege escalation.

• Potential unauthorized access to sensitive data
• Elevation of privileges for attackers
• Possible disruption of database services
• Need for verification of current PgBouncer version and user authentication settings

Technical summary

CVE-2026-107350 is an improper authentication vulnerability in PgBouncer versions 1.17.0 through 1.26.0. An attacker who knows a user's password listed in auth_file can log in as any other user authenticating via SCRAM, including PgBouncer admin users and backend superusers, by sending a second StartupMessage during SCRAM authentication against a non-existent database. This vulnerability allows remote attackers to bypass authentication and potentially gain unauthorized access to sensitive data. The vulnerability has a high CVSS score of 8.8, indicating a high severity level.

Defensive priority

High

Recommended defensive actions

• Review and update PgBouncer to a version outside of 1.17.0-1.26.0 if possible
• Implement additional authentication mechanisms for PgBouncer
• Monitor PgBouncer logs for suspicious authentication attempts
• Verify current PgBouncer version and user authentication settings
• Perform a thorough review of the current configuration and apply necessary changes
• Consider implementing compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the improper authentication vulnerability in PgBouncer. The vendor changelog is referenced but not analyzed. The vulnerability has a high CVSS score of 8.8, indicating a high severity level. There is no information on known exploit or ransomware campaigns using this vulnerability. The CVE record was published on 2026-10-14T18:17:25.670Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.