[{"data":1,"prerenderedAt":223},["ShallowReactive",2],{"seo-verification":3,"blog-pgbouncer-1-26-1-cve-2026-107350-update-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-pgbouncer-1-26-1-cve-2026-107350-update-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":160,"ctaBody":161,"ctaButton":162,"ctaUrl":163,"relatedPosts":164},516,"pgbouncer-1-26-1-cve-2026-107350-update",{"fr":12,"en":10,"ar":13,"es":14},"pgbouncer-1-26-1-cve-2026-107350-mettre-a-jour","ثغرة-pgbouncer-cve-2026-107350-التحديث-إلى-1-26-1","pgbouncer-1-26-1-cve-2026-107350-actualizar","PgBouncer 1.26.1: fix CVE-2026-107350 (SCRAM bypass)","PgBouncer 1.26.1 fixes CVE-2026-107350, a SCRAM authentication bypass. Check your version, port 6432 exposure, apt and Docker upgrades, workarounds and log review.",12,0,false,"2026-10-28T00:00:00+00:00","2026-10-29T03:10:22+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fpgbouncer-1-26-1-cve-2026-107350-mettre-a-jour-poster.svg","On October 14, 2026, PgBouncer 1.26.1 fixed a SCRAM authentication bypass, CVE-2026-107350, along with two denial-of-service flaws. The packages in Debian's stable releases were still listed as vulnerable when we checked, so a plain `apt upgrade` does not settle the matter. It happens that nobody can say which PgBouncer version runs on a server, or who can reach its port. This guide gives the commands to check the version in minutes, upgrade according to your install (PGDG repository, RHEL, Docker, source), apply workarounds in the meantime, then review the logs.",[35,39,75,78,89,114,117,141,145,148,151,154,157],{"type":36,"title":37,"body":38},"h2","What PgBouncer 1.26.1 fixes","On October 14, 2026, the PgBouncer project released version 1.26.1, which fixes three flaws. The most serious, CVE-2026-107350, is an authentication bypass: a client that knows the password of one SCRAM user can log in as any other SCRAM user, including PgBouncer administrators and PostgreSQL superusers. The mechanism is a second startup message, the StartupMessage, processed during SCRAM authentication when the connection targets a non-existent database. According to Mend's description, the SCRAM exchange is still verified against the keys of the first user, while the session opens under the identity of the second. The changelog states that the attack requires SCRAM for both users.\n\nThe other two flaws are denial-of-service issues, triggerable without authentication but only under certain configuration options: CVE-2026-107349 and CVE-2026-107348. Mend gives CVE-2026-107350 a CVSS v4 score of 8.7. The score matters less than a practical question: which version runs on your machines, and who can reach port 6432?",{"type":40,"title":41,"headers":42,"rows":46},"comparison","Affected versions and package status",[43,44,45],"Case","Status","Action",[47,51,54,57,61,63,67,71],[48,49,50],"PgBouncer 1.17.0 to 1.26.0","Affected by CVE-2026-107350 when both accounts use SCRAM","Upgrade to 1.26.1",[52,53,50],"PgBouncer 1.20.0 to 1.26.0","Affected by CVE-2026-107349 if `ignore_startup_parameters` is non-empty without `options`",[55,56,50],"PgBouncer 1.21.0 to 1.26.0","Affected by CVE-2026-107348 only if `max_packet_size` exceeds 2147483648",[58,59,60],"Debian bookworm, package 1.18.0-1+deb12u1","Listed as vulnerable by the Debian security tracker","PGDG repository or build from source",[62,59,60],"Debian trixie, package 1.24.1-1+deb13u2",[64,65,66],"Debian forky and sid, package 1.26.1-1","Fixed","Upgrade through apt",[68,69,70],"Third-party Docker image","Depends on the embedded version","Check `pgbouncer -V` inside the container",[72,73,74],"Version older than 1.17.0","Outside the range announced for CVE-2026-107350","Do not settle for it, plan the upgrade",{"type":36,"title":76,"body":77},"\"My PgBouncer is not exposed\": an insufficient criterion","The objection is fair: a PgBouncer listening only on a private address cannot be reached from the Internet. But the attack needs no brute force. It is enough to know the password of one valid SCRAM user and to reach the port. An application password lives in a `.env` file, a CI variable, a developer workstation, sometimes a log. A compromised application provides both the password and the network position. From there, the flaw turns a limited application account into an administration account, or even a superuser on the PostgreSQL server behind it.\n\nThe deciding criterion is therefore not \"Internet or not\" but two questions: who can open a connection to port 6432, and how many valid passwords are in circulation. A vulnerable version behind a strict firewall is a reduced risk, not a removed one.",{"type":79,"title":80,"items":81},"ul","What determines your real exposure",[82,83,84,85,86,87,88],"**Listen address** — `listen_addr` has no default value: without it, PgBouncer only accepts Unix sockets. The value `*` opens every interface.","**Authentication type** — the attack requires SCRAM for both users. Look at `auth_type` and at the nature of the entries in the file named by `auth_file`.","**Number of accounts** — every valid password is an entry point to all the other SCRAM accounts. Ten application accounts are ten keys to the same door.","**Administration accounts** — `admin_users` opens the console, and the role used to reach PostgreSQL may be a superuser.","**Docker and firewall** — a port published by Docker goes through its own network rules, which often bypass ufw. Check how the port is published, not only the firewall.","**Options tied to the denial-of-service flaws** — `ignore_startup_parameters` non-empty without `options`, or `max_packet_size` raised above its default.","**Containers and bundled stacks** — a PgBouncer shipped in a Compose stack or a chart keeps its image's version, whatever the host server runs.",{"type":90,"title":91,"steps":92},"steps","Check the version and exposure in a few minutes",[93,96,99,102,105,108,111],{"title":94,"body":95},"Query the admin console","`psql -h 127.0.0.1 -p 6432 -U \u003Cadmin_user> pgbouncer -c \"SHOW VERSION;\"`\nOnly users listed in `admin_users` or `stats_users` can connect. The `SHOW VERSION` command prints PgBouncer's version string: after the fix, it must mention 1.26.1.",{"title":97,"body":98},"Read the binary version","`pgbouncer -V`\n`which -a pgbouncer`\nSeveral binaries sometimes coexist, the package one and another under `\u002Fusr\u002Flocal` after a build. The first in the list is not always the one the service runs.",{"title":100,"body":101},"Read the package version","Debian and Ubuntu:\n`dpkg -l pgbouncer`\n`apt-cache policy pgbouncer`\nRHEL, AlmaLinux, Rocky:\n`rpm -q pgbouncer`\n`dnf info pgbouncer`\nCompare with the table above. A distribution package can receive a fix without changing its upstream version number: trust the distribution's security tracker more than the number alone.",{"title":103,"body":104},"Reread the configuration actually loaded","`ps -eo pid,args | grep '[p]gbouncer'`\n`grep -nE '^(listen_addr|listen_port|auth_type|auth_file|admin_users|ignore_startup_parameters|max_packet_size)' \u002Fetc\u002Fpgbouncer\u002Fpgbouncer.ini`\nThe `.ini` file to read is the one passed as an argument to the process, not necessarily the usual path.",{"title":106,"body":107},"See who can reach the port","`sudo ss -ltnp | grep 6432`\n`sudo ufw status numbered`\n`nc -vz \u003Cserver_ip> 6432`\nThe last command, run from another machine, tells you whether the port answers outside the intended network. An unexpected answer calls for an immediate firewall decision.",{"title":109,"body":110},"Count SCRAM accounts without printing secrets","`grep -c 'SCRAM-SHA-256' \u002Fetc\u002Fpgbouncer\u002Fuserlist.txt`\nReplace the path with that of `auth_file`. Never paste the file contents into a ticket or a chat: it holds the fingerprints of your passwords.",{"title":112,"body":113},"Inventory the containers","`docker ps`\n`docker port \u003Ccontainer>`\n`docker exec \u003Ccontainer> pgbouncer -V`\nA running container keeps the image it started with. The `docker port` output says whether the port is published on the host.",{"type":36,"title":115,"body":116},"Which upgrade route: the state of Debian packages","At the time of writing, the Debian security tracker lists bookworm (1.18.0-1+deb12u1) and trixie (1.24.1-1+deb13u2) as vulnerable to CVE-2026-107350, with only forky and sid carrying the fixed package 1.26.1-1. Until Debian publishes a fix for your release, `apt upgrade` alone does not protect you. Recheck the tracker on the day you act: the state may have changed.\n\nThree routes exist. The first: the PGDG repository, apt.postgresql.org for Debian and Ubuntu, yum.postgresql.org for RHEL and derivatives, which the PgBouncer download page describes as builds that may be newer than those in distributions. The second: an up-to-date Docker image or tag, knowing that the project mentions no official image, so you are using a third-party one. The third: build the source archive of version 1.26.1. Before switching, confirm with `apt-cache policy pgbouncer` or `dnf info pgbouncer` that the repository really offers the fixed version.",{"type":90,"title":118,"steps":119},"Upgrade according to your installation method",[120,123,126,129,132,135,138],{"title":121,"body":122},"Back up the configuration","`sudo cp -a \u002Fetc\u002Fpgbouncer \u002Froot\u002Fpgbouncer-etc-backup`\nThis copy lets you roll back if an upgrade replaces a file. Also note the current version before you start.",{"title":124,"body":125},"Debian and Ubuntu: enable the PGDG repository","`sudo apt install -y postgresql-common ca-certificates`\n`sudo \u002Fusr\u002Fshare\u002Fpostgresql-common\u002Fpgdg\u002Fapt.postgresql.org.sh`\n`apt-cache policy pgbouncer`\nThe official script configures the apt.postgresql.org repository. The last command must show a 1.26.1 candidate; if it is missing, go no further with this route.",{"title":127,"body":128},"Debian and Ubuntu: install","`sudo apt update`\n`sudo apt install --only-upgrade pgbouncer`\n`pgbouncer -V`\nIf dpkg offers to replace your configuration file, keep your local version. `pgbouncer -V` confirms the installed binary.",{"title":130,"body":131},"RHEL, AlmaLinux and Rocky","Add the PGDG repository with the commands generated by the yum.postgresql.org selector for your distribution, then:\n`sudo dnf makecache`\n`dnf info pgbouncer`\n`sudo dnf upgrade pgbouncer`\nCheck that the proposed version is 1.26.1 before confirming.",{"title":133,"body":134},"Docker and Compose","`docker compose pull pgbouncer`\n`docker compose up -d pgbouncer`\n`docker compose exec pgbouncer pgbouncer -V`\nIf the image is pinned to an old tag or digest, first update that reference in your Compose file. If no 1.26.1 tag exists, build the image from source.",{"title":136,"body":137},"Build from source","`curl -LO https:\u002F\u002Fwww.pgbouncer.org\u002Fdownloads\u002Ffiles\u002F1.26.1\u002Fpgbouncer-1.26.1.tar.gz`\n`sha256sum pgbouncer-1.26.1.tar.gz`\nCompare the checksum you get with the one published on the download page before continuing.\n`tar xzf pgbouncer-1.26.1.tar.gz`\n`cd pgbouncer-1.26.1`\n`.\u002Fconfigure --prefix=\u002Fusr\u002Flocal`\n`make`\n`sudo make install`\nThe build needs libevent 2.0 or later, OpenSSL 1.0.1 or later and a C11 compiler. The documentation recommends Autoconf for production.",{"title":139,"body":140},"Restart, then verify","`sudo systemctl restart pgbouncer`\n`ps -o lstart= -p $(pgrep -o pgbouncer)`\n`sudo readlink -f \u002Fproc\u002F$(pgrep -o pgbouncer)\u002Fexe`\nA reload is not enough: the process must restart on the new binary. The start time and the executable path prove it. Finally, run `SHOW VERSION` on the console again.",{"type":142,"title":143,"body":144},"tip","Restarting without cutting clients, and the search_path case","A restart drops open connections. The documentation describes an alternative: several processes on the same port with `so_reuseport`, then `SHUTDOWN WAIT_FOR_CLIENTS` on one process at a time while clients reconnect. Another point of attention: since version 1.26.0, `search_path` is tracked by default, and 1.26.1 makes `ignore_startup_parameters` take precedence over tracked parameters. If an application sent `search_path` at startup and you were counting on ignoring it, add `ignore_startup_parameters = search_path` to the configuration to get the 1.25 behavior back.",{"type":36,"title":146,"body":147},"Workarounds until the fix is in","For CVE-2026-107350, the announcement gives no configuration workaround: the upgrade is the only real answer. You can, however, reduce who gets to try. Limit port 6432 to the application network:\n`sudo ufw allow from \u003Capp_subnet> to any port 6432 proto tcp`\n`sudo ufw status numbered`\n`sudo ufw delete \u003Cn>`\nHere `\u003Cn>` is the number of a broader rule already present, for example one opening port 6432 to everyone, which you delete once the restricted rule is in place. On RHEL and derivatives, the same rule is set with firewalld. If `listen_addr` is `*`, replace it with the server's private address. Then audit the `auth_file` file: remove unused accounts, rotate passwords that have circulated, and shrink `admin_users` to the bare minimum.\n\nFor the two denial-of-service flaws, what follows is our reading of the changelog's conditions, not a vendor instruction. CVE-2026-107349 assumes `ignore_startup_parameters` is non-empty and lacks `options`: adding `options` to the list removes the condition; emptying the setting also removes it, but may cause clients that send startup parameters to be rejected (see the `search_path` case above). CVE-2026-107348 assumes a `max_packet_size` above 2147483648: keeping the default value, 2147483647, rules it out.",{"type":36,"title":149,"body":150},"Review the traces of an impersonated connection","By default PgBouncer logs successful connections and disconnections, with their reason, thanks to `log_connections` and `log_disconnections`. Read the period that follows the publication of the fixes, and further back if your logs allow:\n`sudo journalctl -u pgbouncer --since \"2026-10-14\"`\nLook for attempts against database names that do not exist in your `[databases]` section, then a session opened just afterwards under a different user name from the same address. On the console, these two commands show the current state:\n`psql -h 127.0.0.1 -p 6432 -U \u003Cadmin_user> pgbouncer -c \"SHOW DATABASES;\"`\n`psql -h 127.0.0.1 -p 6432 -U \u003Cadmin_user> pgbouncer -c \"SHOW CLIENTS;\"`\nOn the PostgreSQL side, list the roles and their recent changes with `psql -c \"\\du\"`.\n\nWe do not have an exact signature of this attack in the logs, and we do not invent one. An absence of traces does not prove an absence of intrusion, especially if `log_connections` was turned off or logs have rotated. If you have serious doubts, change the passwords of all SCRAM accounts and of the privileged roles on the PostgreSQL server.",{"type":36,"title":152,"body":153},"Closing the file: from version to follow-up","A successful upgrade is proven, not assumed. For each server, record in a table the machine, the installation method, the version before and after, the firewall rule applied, and the date of the check. Verify that `SHOW VERSION` reports 1.26.1, that the process restarted after the installation, and that port 6432 is reachable only from the intended network. Also confirm that your two denial-of-service settings respect the conditions described above, or that they have become moot.\n\nFinally, do not count on automatic updates: an unfixed distribution package does not update itself, and neither does a pinned Docker image. Add a reminder to recheck your distribution's security tracker, then switch to its package once it is fixed, or keep the PGDG repository deliberately.",{"type":36,"title":155,"body":156},"On a VPS of your own, you hold the three levers","Fixing PgBouncer takes three kinds of access: choosing the installed version, setting the firewall on port 6432 and reading the logs. On a VPS Cloud with root access, these three levers are yours, without depending on a shared host's schedule. The guides linked below this article detail the firewall and the PostgreSQL setup. This guide is provided without support: the upgrade remains your responsibility. If you would rather delegate server administration, the VPS administration option exists, to be assessed against your needs.",{"type":36,"title":158,"body":159},"The official documentation","Announcement of version 1.26.1: https:\u002F\u002Fwww.postgresql.org\u002Fabout\u002Fnews\u002Fpgbouncer-1261-released-fixes-three-cves-3403\u002F\n\nPgBouncer changelog: https:\u002F\u002Fwww.pgbouncer.org\u002Fchangelog.html\n\nPgBouncer downloads: https:\u002F\u002Fwww.pgbouncer.org\u002Fdownloads\u002F\n\nUsage and admin console: https:\u002F\u002Fwww.pgbouncer.org\u002Fusage.html\n\nPgBouncer configuration: https:\u002F\u002Fwww.pgbouncer.org\u002Fconfig.html\n\nDebian security tracker for CVE-2026-107350: https:\u002F\u002Fsecurity-tracker.debian.org\u002Ftracker\u002FCVE-2026-107350\n\nMend entry for CVE-2026-107350: https:\u002F\u002Fwww.mend.io\u002Fvulnerability-database\u002FCVE-2026-107350\u002F\n\nPostgreSQL apt repository: https:\u002F\u002Fwiki.postgresql.org\u002Fwiki\u002FApt\n\nPostgreSQL yum repository: https:\u002F\u002Fyum.postgresql.org\u002F\n\nDocker and firewalls: https:\u002F\u002Fdocs.docker.com\u002Fengine\u002Fnetwork\u002Fpacket-filtering-firewalls\u002F","A server whose version and firewall you control","On a VPS Cloud with root access, you choose the PgBouncer version, close port 6432 to the intended machines only and read your own logs. The VPS administration option lets you delegate that follow-up.","See VPS Cloud plans","\u002Fvps-cloud",[165,189,205],{"id":166,"slug":167,"slugs":168,"title":172,"excerpt":173,"readTime":174,"views":18,"isPinned":19,"publishedAt":175,"updatedAt":176,"category":177,"categories":183,"featuredImage":30,"bgImage":31,"posterImage":185,"relatedSolution":186},56,"postgresql-on-a-vps-a-reliable-and-controlled-database",{"fr":169,"en":167,"ar":170,"es":171},"heberger-postgresql-vps","postgresql-على-خادم-vps-قاعدة-بيانات-موثوقة-ومتحكم-بها","alojar-postgresql-en-un-vps","PostgreSQL on a VPS: reliable, controlled database","Host PostgreSQL on a VPS: production config, pgBackRest backups, streaming HA, RDS\u002FSupabase\u002FNeon comparison and OOM troubleshooting.",9,"2026-04-25T00:00:00+00:00","2026-10-21T15:21:37+00:00",{"id":178,"name":179,"slug":180,"color":181,"icon":182},6,"Databases","bases-de-donnees","bg-teal-500\u002F10 text-teal-400","database",[184],{"id":178,"name":179,"slug":180,"color":181,"icon":182},"\u002Fblog\u002Fcovers\u002Fheberger-postgresql-vps-poster.svg",{"categorySlug":187,"appSlug":188},"databases","postgresql-stack",{"id":190,"slug":191,"slugs":192,"title":196,"excerpt":197,"readTime":198,"views":18,"isPinned":19,"publishedAt":199,"updatedAt":200,"category":201,"categories":202,"featuredImage":30,"bgImage":31,"posterImage":204,"relatedSolution":30},115,"configure-your-vps-firewall-with-ufw",{"fr":193,"en":191,"ar":194,"es":195},"pare-feu-ufw-vps","تهيئة-جدار-الحماية-ufw-على-خادمك-vps","configurar-firewall-ufw-vps","Configure Your VPS Firewall with UFW","Configure your VPS firewall with UFW step by step: rules, ports, SSH rate limiting and best practices to reduce the attack surface.",4,"2026-02-25T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[203],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fpare-feu-ufw-vps-poster.svg",{"id":206,"slug":207,"slugs":208,"title":212,"excerpt":213,"readTime":198,"views":214,"isPinned":19,"publishedAt":215,"updatedAt":200,"category":216,"categories":217,"featuredImage":30,"bgImage":31,"posterImage":219,"relatedSolution":220},109,"fail2ban-enhanced-on-vps-blocking-repeated-attacks",{"fr":209,"en":207,"ar":210,"es":211},"proteger-vps-fail2ban","fail2ban-enhanced-على-خادم-vps-حجب-الهجمات-المتكررة","fail2ban-en-vps-bloquear-ataques-repetidos","Fail2Ban Enhanced on VPS: blocking repeated attacks","Link Fail2Ban Enhanced to the ServOrbit catalog: SSH\u002FNginx banning, readable logs and official documentation.",1,"2026-03-03T00:00:00+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[218],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fproteger-vps-fail2ban-poster.svg",{"categorySlug":221,"appSlug":222},"securite","fail2ban-enhanced",1793251368534]