# PgBouncer 1.26.1 closes a SCRAM authentication bypass that can reach database superusers The October 14 PgBouncer security release fixes a SCRAM cross-account login flaw and two remotely triggerable denial-of-service loops. A client with one valid SCRAM password could authenticate as another user, including a PostgreSQL backend superuser, under the documented conditions. PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change. - Status: Active - Published: 2026-10-15T06:33:24+13:00 - Updated: 2026-10-15T06:33:24+13:00 - Categories: Cloud & Infrastructure, Deployment & DevOps, Databases & Storage - Tags: PgBouncer, PostgreSQL, security - Canonical HTML: https://beyondthe.news/dossiers/pgbouncer-1-26-1-scram-auth-bypass-three-cves-october-2026 ## What changed On 14 October 2026, PgBouncer maintainers released version 1.26.1 with fixes for CVE-2026-107350, CVE-2026-107349 and CVE-2026-107348. The most consequential issue is a SCRAM authentication state-machine error: if a client knows the password of one SCRAM user, it can under specific circumstances present a second StartupMessage during authentication to a nonexistent database and be accepted as another SCRAM user, potentially including PgBouncer administrators and backend PostgreSQL superusers. The other two bugs can make PgBouncer loop indefinitely on malformed client startup data without authentication. The release also changes how ignored startup parameters take precedence. ## Why it matters PgBouncer is often placed directly between applications and PostgreSQL to pool connections. Its authentication boundary is therefore more sensitive than an ordinary application dependency: an incorrect identity handoff can compromise database role isolation, while an unauthenticated infinite loop can exhaust service capacity. Operators of multi-tenant apps, SaaS backends and shared PostgreSQL clusters should check the PgBouncer binary actually running in front of each database and upgrade rather than relying on the backend's own patch status. ## A known SCRAM password could become a different identity CVE-2026-107350 does not mean any unauthenticated visitor can immediately become a database superuser. The documented prerequisite is knowledge of at least one SCRAM user's password. A second StartupMessage arriving during SCRAM authentication to a nonexistent database could then cause PgBouncer to authenticate that client as a different SCRAM user, including administrators and backend superusers. The distinction matters for assessing exposure: pooled environments with multiple database roles or credentials of differing privilege levels face an identity-boundary failure. ## Two denial-of-service paths need no login CVE-2026-107349 is an infinite loop when the startup options parameter contains an empty option name and ignore_startup_parameters is nonempty without listing options. CVE-2026-107348 is another infinite loop in packet-buffer growth caused by an integer overflow; this one requires max_packet_size to be configured above its default. Both can be triggered by unauthenticated clients, but the configuration preconditions differ. Administrators should not assume every installation has the same exposure to both issues. ## The security release also changes parameter precedence In 1.26.1, ignore_startup_parameters takes precedence over tracked parameters. Setting ignore_startup_parameters = search_path again ignores search_path, matching PgBouncer 1.25 behaviour. That compatibility detail matters for teams relying on startup-session settings and can change how a connection pool handles application-supplied search paths. Test relevant client configuration after the security update. ## Patch the connection pooler, not just PostgreSQL The release and PostgreSQL project's news notice both recommend 1.26.1. Operators should inventory self-hosted and provider-managed PgBouncer instances, determine whether any are externally reachable, test connection/authentication flows, and update the pooler. This is a different product and advisory from the Pgpool-II security release already covered by BTN; the two should not be confused. The official notice does not establish widespread exploitation, so exploit prevalence should not be inferred. ## Key details - Release: PgBouncer 1.26.1, October 14, 2026. - CVE-2026-107350: SCRAM authentication bypass requiring knowledge of one SCRAM user's password; cross-user login may include backend superusers. - CVE-2026-107349: unauthenticated startup options infinite-loop DoS under specified ignore_startup_parameters configuration. - CVE-2026-107348: unauthenticated packet-buffer growth DoS when max_packet_size exceeds default. - ignore_startup_parameters now takes precedence over tracked parameters; search_path compatibility restored. - No independently confirmed widespread exploitation identified at research time. ## Builder takeaways - Identify the exact PgBouncer version in every application-to-PostgreSQL path; patch the pooler to 1.26.1. - Treat one compromised low-privilege SCRAM credential as potentially more dangerous on affected poolers, because the vulnerability crosses user identity boundaries. - Review public or untrusted client access to PgBouncer and configuration-specific DoS conditions. - Test startup options, especially search_path, after upgrading. ## What to watch - Downstream package and managed-service rollout of 1.26.1. - Vendor or maintainer clarification of affected configurations and exploitability. - Any credible reports of active exploitation or additional authentication regressions. ## Uncertainties - The official announcement does not quantify deployments exposed or report exploitation in the wild. - The two DoS vulnerabilities have different configuration preconditions; not every instance necessarily meets them. - Some managed-service operators may roll out fixes on a different timetable. ## Sources - [PgBouncer 1.26.1 release announcement](https://www.pgbouncer.org/2026/10/pgbouncer-1-26-1) — PgBouncer project · primary · 2026-10-14T00:00:00+13:00. Maintainer's three CVEs, exploit preconditions, compatibility change and fixed version. - [PgBouncer 1.26.1 released — Fixes three CVEs](https://www.postgresql.org/about/news/pgbouncer-1261-released-fixes-three-cves-3403/) — PostgreSQL project news · primary syndication · 2026-10-14T00:00:00+13:00. PostgreSQL.org carries PgBouncer maintainer's release details; not independent reproduction.