Vulnerabilities CVE-2026-6667

CVE-2026-6667

Medium

Open

TLP:CLEAR

PgBouncer missing authorization check in KILL_CLIENT admin command

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.

Details

CVSS Score: 4.3
EPSS Score ⓘ: 0.29%

21.1th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Confidence: 90%
Published: May 9, 2026
Last Modified: May 9, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.