Bug 2552733 (CVE-2026-107350)
| Summary: | CVE-2026-107350 pgbouncer: pgbouncer: Privilege escalation via secondary startup message during SCRAM authentication | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in PgBouncer. An improper authentication vulnerability allows a remote attacker possessing valid credentials for any listed user to impersonate any other user configured with Salted Challenge Response Authentication Mechanism (SCRAM), including PgBouncer administrators and backend superusers. By sending a second connection startup message targeted at a non-existent database during an active SCRAM exchange, the target identity is switched while authentication is verified against the initial user credentials. This issue enables an authenticated attacker to achieve privilege escalation and obtain unauthorized administrative access across the database environment.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2553068, 2553069 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-14 17:52:05 UTC
|