Skip to content

PgBouncer patches a critical bug that lets any SCRAM user log in as admin

Version 1.26.1 fixes an authentication bypass reachable by anyone who knows one SCRAM password, plus two unauthenticated denial-of-service bugs.

Source: PgBouncer

PgBouncer 1.26.1, released today, fixes CVE-2026-107350: a client that knows the password of one SCRAM user can log in as any other SCRAM user, including admins and backend superusers. The bug comes from PgBouncer processing a second StartupMessage sent during SCRAM authentication when it connects to a non-existent database. It affects every release from 1.17.0 through 1.26.0.

The same release fixes two unauthenticated denial-of-service bugs. CVE-2026-107349 (1.20.0 through 1.26.0) lets an unauthenticated client trigger an infinite loop with an empty option name in the startup parameters, if ignore_startup_parameters is set but doesn’t include options. CVE-2026-107348 (1.21.0 through 1.26.0) is an integer overflow in the packet buffer growth logic, triggered when max_packet_size is raised above its default. Neither needs a valid login.

PgBouncer 1.17.0 - 1.26.0  -> vulnerable to CVE-2026-107350
PgBouncer 1.26.1            -> fixed

Why it matters: PgBouncer sits in front of Postgres on most production stacks that need connection pooling, including Supabase’s. An auth bypass that turns one compromised SCRAM password into admin access on the pooler is worth an unscheduled upgrade, not a routine one.

Share

Related reading

Engineering

The N+1 you cannot see

Everyone knows to eager load. The queries that actually take sites down are the ones hiding in an accessor, a Blade partial, or a policy. There is a one-line switch that finds all of them.

Engineering

Database indexes, explained with a phone book

Most slow queries are one index away from being fast. The reason people do not add it is that nobody ever explained what the index is actually doing.

WordPress

WP_Query is fast until it is not

WordPress will happily let you write a query that scans a million meta rows. Here is which arguments are expensive, why, and what to do instead.

More from The Wire

All briefs

GitHub Copilot retires six AI models today

Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 stop working across Copilot Chat, inline edits, agent mode and completions from today.

via GitHub