PgBouncer before version 1.25.2 does not properly enforce authorization for the KILL_CLIENT administrative command. While access to the administration console requires authorization, all users with such access could run KILL_CLIENT, which should have been limited to those listed in the admin_users parameter. This missing authorization check could allow authorized console users to terminate client connections improperly, potentially causing denial of service. The vulnerability is assigned CVE-2026-6667 and has a CVSS v3.1 base score of 4.3, indicating medium severity. There is no vendor advisory or patch information currently available to confirm remediation status.

The impact is limited to denial of service by allowing any user with administration console access to terminate client connections via the KILL_CLIENT command. There is no confidentiality or integrity impact reported. The vulnerability requires at least low privileges to access the admin console, so exploitation is limited to authorized users of that interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the PgBouncer administration console to trusted users only. Monitor for vendor updates regarding patches or configuration changes that enforce proper authorization for the KILL_CLIENT command.