CVE-2026-107350 Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Remote attackers can bypass authentication to log in as any user, including admins, by exploiting a flaw in SCRAM authentication handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107350?
CVE-2026-107350 is a high-severity authentication bypass vulnerability in PgBouncer, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
Weakness: CWE-287
Which versions are affected by CVE-2026-107350?
1 open source package ship an affected version, including pgbouncer.
| Package | Affected | Fixed in |
|---|---|---|
pgbouncer Bitnami | From 1.17.0 | 1.26.1 |
How do I fix CVE-2026-107350?
Upgrade pgbouncer to 1.26.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-107350 being exploited?
There is no known exploitation of CVE-2026-107350 in the wild and no public exploit code.
Sources
Also known as AZL-108189, BIT-pgbouncer-2026-107350, DEBIAN-CVE-2026-107350, ECHO-67d6-1d9f-3ccf, GHSA-qcxp-3cx5-3f3g, UBUNTU-CVE-2026-107350.