PgBouncer EUVD-2025-201089

Exploitation requires PgBouncer to be configured with the auth_query feature, which runs a query against the backend database to look up user credentials during authentication; the untrusted search_path supplied in the client's StartupMessage is propagated into that auth_query connection, enabling object-resolution hijacking and arbitrary SQL execution. The principal limiting factor is this non-default dependency: deployments that do not use auth_query (e.g. those relying on a static userlist / auth_file) are not exposed. No prior authentication is required (PR:N) and no user interaction is needed, but the high attack complexity (AC:H) reflects the configuration prerequisite and the need to craft objects that the manipulated search_path will resolve. Affects all PgBouncer versions before 1.25.1.

This is a genuine high-priority vulnerability where the signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, base 8.1) describes a network-reachable, unauthenticated (PR:N) flaw with full confidentiality, integrity, and availability impact, tempered only by high attack complexity (AC:H) - which here reflects the dependency on PgBouncer being configured with the auth_query feature rather than any intrinsic exploit difficulty. The patch is confirmed available (PgBouncer 1.25.1; Debian DLA-4422-1), and distributions (Ubuntu medium priority across 8 releases, Debian 6 releases) have tracked and shipped fixes, confirming the affected-version data. Counterbalancing this, the EPSS score is low (0.16%, 37th percentile), there is NO CISA KEV listing, and no public exploit code was identified in the provided data - so there is no evidence of active or imminent widespread exploitation at time of analysis. The practical read: real priority for any environment running PgBouncer with auth_query enabled (SQL execution in the privileged auth connection context is severe), but the low EPSS and absence of KEV/POC suggest it is not yet being mass-exploited. The AC:H and the auth_query configuration prerequisite meaningfully narrow the exposed population below the raw 8.1 score.

An attacker connects to a PgBouncer instance configured with auth_query and sends a PostgreSQL StartupMessage containing a crafted search_path parameter. Because PgBouncer passes this untrusted search_path into the backend connection used to run auth_query during authentication, the attacker can cause attacker-controlled schema objects (e.g. functions) to be resolved and executed, running arbitrary SQL in the context of the privileged auth_query user before authentication completes. No public exploit code was identified at time of analysis.