PgBouncer 1.26.1 has been released, and it is a security-driven patch rather than a feature drop. The connection pooler that sits in front of most production PostgreSQL clusters fixes three CVEs in this version, one of which is an authentication bypass with serious blast radius. Anyone running 1.26.0 or earlier should treat the upgrade as urgent, since two of the three issues are reachable by unauthenticated clients.
The concrete changes in this release:
- CVE-2026-107350 — an authentication bypass where a client knowing the password of one SCRAM user could log in as any other SCRAM user, including admins and backend superusers. It is caused by a second
StartupMessagebeing processed during SCRAM authentication when connecting to a non-existent database. - CVE-2026-107349 — a denial of service via infinite loop, triggerable by unauthenticated clients. It stems from an empty option name in the
optionsstartup parameter, occurring whenignore_startup_parametersis non-empty but does not containoptions. - CVE-2026-107348 — a denial of service via infinite loop, also triggerable by unauthenticated clients. This one comes from an integer overflow in the packet buffer growth logic and only triggers when
max_packet_sizeis set above its default. ignore_startup_parametersnow takes precedence over tracked parameters, so settingignore_startup_parameters = search_pathrestores the 1.25 behaviour of ignoringsearch_path.
The search_path change is the one to watch during rollout: pools that relied on the new tracked-parameter handling will see the old semantics return as soon as the flag is set. For most teams the practical action is a fast upgrade to 1.26.1, followed by an audit of whether max_packet_size is customised and whether your SCRAM users share a trust boundary. The first CVE makes privilege escalation a one-password problem, so rotating credentials alone is not sufficient mitigation.
Source: https://www.postgresql.org/about/news/pgbouncer-1261-released-fixes-three-cves-3403/