CVE-2026-107350
Description
A flaw was found in PgBouncer. An improper authentication vulnerability allows a remote attacker possessing valid credentials for any listed user to impersonate any other user configured with Salted Challenge Response Authentication Mechanism (SCRAM), including PgBouncer administrators and backend superusers. By sending a second connection startup message targeted at a non-existent database during an active SCRAM exchange, the target identity is switched while authentication is verified against the initial user credentials. This issue enables an authenticated attacker to achieve privilege escalation and obtain unauthorized administrative access across the database environment.
Statement
Red Hat has evaluated this vulnerability as Important severity because an authenticated remote user with valid credentials can gain unauthorized administrative privileges over the database tier, potentially compromising data confidentiality and integrity across all managed databases. Although exploitation requires legitimate credentials for at least one account, the ability to jump from low-privilege client access to backend superuser status represents a substantial escalation beyond expected authorization boundaries. In typical Red Hat environments where PgBouncer pools connections for external applications, exposing the pooler to multiple untrusted or semi-trusted tenants elevates the risk of complete infrastructure takeover.
Mitigation
Limit network access to the PgBouncer daemon so that only trusted application hosts can establish connections.
1. Using firewalld, restrict traffic on the PgBouncer port (default 6432/tcp) to specific authorized client IP addresses:
# firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_CLIENT_IP>
# firewall-cmd --permanent --zone=trusted --add-port=6432/tcp
# firewall-cmd --permanent --remove-port=6432/tcp --zone=public
# firewall-cmd --reload
Alternatively, if clients reside on the same host, bind PgBouncer exclusively to the loopback interface by configuring `listen_addr = 127.0.0.1` in `/etc/pgbouncer/pgbouncer.ini` and applying changes:
# systemctl reload pgbouncer
Caveats: Restricting network reachability prevents untrusted network hosts from connecting, but it does not protect against malicious or compromised clients residing within the permitted network range. Modifying firewall rules or reloading the PgBouncer service may briefly disrupt active client connections.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Alter Execution Logic; Unexpected State
By performing actions in an unexpected order, or by omitting steps, an attacker could manipulate the business logic of the product or cause it to enter an invalid state. In some cases, this can also expose resultant weaknesses with security implications.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
