CVE-2026-107350: Improper Authentication in PgBouncer

This vulnerability in PgBouncer (versions 1.17.0 through 1.26.0) allows an attacker with knowledge of a valid user's password to bypass proper authentication controls. By sending a second StartupMessage during SCRAM authentication targeting a non-existent database, the attacker can switch the user identity to another SCRAM-authenticated user, including administrative and superuser accounts, without re-verifying credentials. This flaw arises from improper handling of authentication messages, enabling privilege escalation and unauthorized access.

An attacker who knows the password of any user listed in the PgBouncer auth_file can impersonate any other SCRAM-authenticated user, including PgBouncer administrators and backend superusers. This leads to complete compromise of PgBouncer's authentication mechanism, potentially allowing unauthorized access to sensitive database functions and data, with full confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to PgBouncer authentication files and monitor for suspicious authentication attempts. Avoid exposing PgBouncer to untrusted networks and consider additional network-level access controls.