CVE-2026-107350

{
  "etk_id": "ETK-2026-1606",
  "cve_id": "CVE-2026-107350",
  "display_id": "CVE-2026-107350",
  "ghsa_id": "GHSA-qcxp-3cx5-3f3g",
  "euvd_id": "EUVD-2026-101500",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authentication in PgBouncer SCRAM login handling",
  "summary": "PgBouncer versions 1.17.0 through 1.26.0 can allow an attacker to assume the identity of another account that uses SCRAM authentication, including privileged accounts. Exploitation requires the attacker to already know the password for an account listed in the PgBouncer authentication file.",
  "mitigation": "Upgrade PgBouncer to version 1.26.1 or later. Until upgraded, restrict network access to PgBouncer and rotate or remove exposed credentials from the authentication file.",
  "vendor": null,
  "product": "PgBouncer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.17.0, < 1.26.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.26.1"
      ],
      "package_name": "PgBouncer",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0036,
  "epss_percentile": 0.2846,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.5935513,
  "t0_at": "2026-10-14T17:34:39.009000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T17:34:39.009000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T17:34:39.009000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107350"
    }
  }
}