PgBouncer EUVD-2026-101500

Requires that PgBouncer (version 1.17.0-1.26.0) is configured to use SCRAM authentication with an auth_file, and that the attacker already knows the valid password of at least one user listed in that auth_file (PR:L). The core trigger is PgBouncer's failure to reject a second StartupMessage sent during the SCRAM exchange against a non-existent database, which switches the authenticating identity while still verifying against the first user's keys. Limiting factors: the target victim users must authenticate via SCRAM; the attacker must hold one legitimate auth_file credential; and benefit is greatest where high-value targets (PgBouncer admin users or backend superusers) are reachable through the same pooler. It does not grant access to users not authenticating via SCRAM.

This is a genuine high-priority issue for any environment running PgBouncer as a PostgreSQL connection pooler. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges - specifically, knowledge of the password of ANY single user listed in auth_file - to pivot into logging in as any SCRAM-authenticated user, including PgBouncer admin users and backend superusers. The full C:H/I:H/A:H impact (yielding effective superuser on the backend database) makes the 8.8 base score credible rather than inflated. Tempering the raw score: exploitation is not fully unauthenticated - the attacker must already possess valid credentials for one auth_file user (PR:L), so this is primarily a privilege-escalation / lateral-movement primitive for an insider or an attacker who has already harvested one credential, not a pure remote-unauthenticated takeover. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no current evidence of active or widespread exploitation; the risk is driven by the severity of the outcome and the low bar for an already-credentialed attacker rather than by observed in-the-wild activity. No signals are directly conflicting, but the absence of exploitation telemetry (EPSS/KEV) means prioritization should rest on whether PgBouncer is internet-exposed or multi-tenant in your environment.

An attacker (or malicious tenant) who holds the password of a single low-privilege user listed in PgBouncer's auth_file connects over the network and begins a SCRAM authentication handshake. Mid-exchange they send a second StartupMessage naming a non-existent database, which silently switches the identity being logged in as to a higher-privileged target (e.g., a PgBouncer admin or backend superuser) while PgBouncer still validates the SCRAM proof against the original, known user's keys. The handshake completes and the attacker obtains a session as the privileged target. No public exploit code was identified in the provided data.