What’s Vulnerable › Vulnerabilities
CVE-2026-6667: PgBouncer missing authorization check in KILL_CLIENT admin command
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-09 · updated 2026-07-24
- Weakness: CWE-862
Description
PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.
Affected products
- PgBouncer: before 1.25.2 — fixed in 1.25.2
How to fix
Upgrade to a fixed version: PgBouncer 1.25.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-6667 or the next vulnerability affects your stack