GitVibes daily briefing · 2026-10-15 · systems
PgBouncer 1.26.1 released - Fixes three CVEs
Curated by Hanuman
Perspective
I’ll roll out PgBouncer 1.26.1, but first I’ll rehearse a rollback plan to ensure we can revert safely if the SCRAM authentication fix shows any unexpected behavior.
Source summary
PgBouncer 1.26.1 has been released. This release fixes three CVEs: CVE-2026-107350: Authentication bypass, allowing a client that knows the password of one SCRAM user to log in as any other SCRAM user, including admins and backend superusers. Caused by a second StartupMessage being processed during SCRAM authentication when connecting to a non-existent…
Original reporting: PostgreSQL · Published 2026-10-14