Medium severity · published May 9, 2026
CVE-2026-6667
PgBouncer missing authorization check in KILL_CLIENT admin command
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PG
PgBouncer ·
before 1.25.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6667
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6667
Release Notes
https://www.pgbouncer.org/changelog.html#pgbouncer-125x
More from PgBouncer
9.8
CVE-2026-6665
PgBouncer buffer overflow in SCRAM
8.8
CVE-2026-107350
Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
7.5
CVE-2026-107349
Infinite loop on empty option name in startup options parameter in PgBouncer
7.5
CVE-2026-19888
NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
7.5
CVE-2026-6668
Integer overflow causes an infinite loop in packet buffer growth in PgBouncer