PgBouncer: Authentication bypass via second StartupMessage in SCRAM authentication

Summary

PgBouncer versions 1.17.0 through 1.26.0 accept a second StartupMessage during SCRAM authentication when the client targets a non-existent database. The login then switches to another user while the SCRAM exchange is still verified against the first user's keys. An attacker who knows the password of a user listed in auth_file can log in as any other SCRAM user, including PgBouncer admin users and backend superusers, which can lead to full compromise of the PostgreSQL database. The attack requires SCRAM authentication for both users; the default configuration is not affected.

Affected

• PgBouncer 1.17.0 through 1.26.0
• Conditions: SCRAM authentication is used for both the attacker's user and the impersonated user; the impersonated user can come from auth_file or auth_query

Fixed in

• PgBouncer 1.26.1 (released 2026-10-14)

Workaround

• No vendor-documented workaround found.
• Vendor note: the issue requires SCRAM for both users; hardening measures are the operator's own suggestions, not vendor guidance.

Exploitation

• Exploited in the wild: none known.
• Not listed in CISA KEV.
• Public proof of concept: none found in our research (this does not prove that none exists).
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS was about 0.0037 when captured.

Our recommendation

• Upgrade PgBouncer to version 1.26.1 or later as soon as possible. Check your distribution's security tracker for the exact package version.
• Until the upgrade, restrict network access to the PgBouncer port to the application hosts that need it.
• Review and limit the accounts listed in auth_file.
• Restrict access to the admin console.
• Monitor logins and check for unexpected user switches in logs.
• Priority: high if PgBouncer fronts production PostgreSQL with SCRAM users; medium if it runs on a tightly segmented internal network.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• PgBouncer changelog www.pgbouncer.org
• PostgreSQL news on PgBouncer 1.26.1 www.postgresql.org
• OSV record (Bitnami) osv.dev
• OpenCVE CVE-2026-107350 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:43.