PgBouncer 1.26.1 fixes a SCRAM login bypass and two hang bugs

PgBouncer 1.26.1 fixes a SCRAM login bypass and two hang bugs

14 October 2026: PgBouncer 1.26.1, released on 14 October, fixes CVE-2026-107350, an authentication bypass in versions 1.17.0 to 1.26.0 that lets a client who knows the password of one SCRAM user log in as any other SCRAM user, including PgBouncer admins and database superusers. The release also fixes two denial-of-service bugs that unauthenticated clients can trigger under particular settings. No exploitation is mentioned in the release.

How the login bypass works

The bug sits in the startup handshake. When a client connected to a database name that does not exist, PgBouncer would process a second StartupMessage sent in the middle of SCRAM authentication. An attacker who holds the password of any user listed in auth_file could use that to switch identity and finish authenticating as someone else. Both the attacker's account and the target must use SCRAM, and the target can come from auth_file or from auth_query, so pools that look users up in the database are not protected by keeping auth_file small.

This matters more than the CVE text suggests in shared environments. A pooler often fronts many applications, each with its own low-privilege account. Any one of those application passwords, if leaked, becomes a route to a superuser session through the pooler.

The two hang bugs

• CVE-2026-107349, versions 1.20.0 to 1.26.0: a startup options parameter with an empty option name, such as -c=, sends PgBouncer into an endless loop on one CPU core, and it stops serving every client. Only reachable when ignore_startup_parameters is set but does not include options.
• CVE-2026-107348, versions 1.21.0 to 1.26.0: a packet header declaring a length above 2^31 overflows the buffer growth logic and hangs the process. Only reachable when max_packet_size has been raised to 2147483649 or more; the default of 2147483647 is safe. Since 1.23.0 it can be reached before authentication.

The changelog notes the second is the same class of bug as CVE-2026-6668, fixed in a different buffer implementation in 1.26.0 three weeks earlier.

Fixed version and one behaviour change

All three are fixed in 1.26.1, the only fixed release named. The update also makes ignore_startup_parameters take precedence over tracked parameters. Version 1.26.0 started tracking search_path by default, which quietly made ignore_startup_parameters = search_path stop working; adding search_path there now restores the 1.25 behaviour. The project says other search_path tracking bugs reported since 1.26.0 will be fixed later.

Checking exposure before the upgrade

If SCRAM is not used for both the attacker's and the target's account, the bypass does not apply, so deployments still on md5 or certificate authentication are outside it. For the hang bugs, checking two settings is enough: whether ignore_startup_parameters is non-empty without options, and whether max_packet_size has been raised above its default. Distribution packages often lag the upstream tarball, so check the package version rather than assuming an update has landed. Our relational database category lists PostgreSQL among 35 products.

Sources

• PgBouncer: PgBouncer 1.26.1 release post, 14 October 2026
• PgBouncer: Changelog, 1.26.1 "Only startup once", 14 October 2026
• PostgreSQL news: PgBouncer 1.26.1 released, fixes three CVEs, 14 October 2026