VYPR
← All advisories
Medium severity4.3NVD Advisory· Published May 9, 2026· Updated May 14, 2026

CVE-2026-6667

CVE-2026-6667

Description

PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.

Affected products

2
  • Pgbouncer/Pgbouncerinferred2 versions
    <1.25.2+ 1 more
    • (no CPE)range: <1.25.2
    • cpe:2.3:a:pgbouncer:pgbouncer:*:*:*:*:*:*:*:*range: <1.25.2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

1