Поиск уязвимостей
Количество 9
Количество 9
BDU:2026-16850
Уязвимость программного обеспечения для пула соединения в PostgreSQL PgBouncer, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти существующие механизмы безопасности и получить несанкционированный доступ к системе
ALT-PU-2026-18885
ALT-PU-2026-18885: package `pgbouncer` update to version 1.26.1-alt1
ALT-PU-2026-18565
ALT-PU-2026-18565: package `pgbouncer` update to version 1.26.1-alt1
CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
CVE-2026-107350
Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a re ...
GHSA-qcxp-3cx5-3f3g
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2026-16850 Уязвимость программного обеспечения для пула соединения в PostgreSQL PgBouncer, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти существующие механизмы безопасности и получить несанкционированный доступ к системе | CVSS3: 8.8 | 0% Низкий | 26 дней назад |
| ALT-PU-2026-18885 ALT-PU-2026-18885: package `pgbouncer` update to version 1.26.1-alt1 | CVSS3: 8.8 | 14 дней назад | |
| ALT-PU-2026-18565 ALT-PU-2026-18565: package `pgbouncer` update to version 1.26.1-alt1 | CVSS3: 8.8 | 24 дня назад | |
 | CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user. | CVSS3: 8.8 | 0% Низкий | 26 дней назад |
 | CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user. | CVSS3: 8.8 | 0% Низкий | 26 дней назад |
 | CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user. | CVSS3: 8.8 | 0% Низкий | 26 дней назад |
 | CVE-2026-107350 Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer | CVSS3: 8.8 | 0% Низкий | 24 дня назад |
| CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a re ... | CVSS3: 8.8 | 0% Низкий | 26 дней назад |
| GHSA-qcxp-3cx5-3f3g Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user. | CVSS3: 8.8 | 0% Низкий | 26 дней назад |
Уязвимостей на страницу