Vulnerability · Published May 9, 2026 · Assigned by PostgreSQL
CVE-2026-6667PgBouncer missing authorization check in KILL_CLIENT admin command
Medium 4.3
In plain English
A medium-severity missing authorization in PgBouncer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 78.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pgbouncer | no fix listed | DEBIAN-CVE-2026-6667 |
| Debian:13 | pgbouncer | 1.24.1-1+deb13u2 | DEBIAN-CVE-2026-6667 |
| Debian:14 | pgbouncer | 1.25.2-1 | DEBIAN-CVE-2026-6667 |
| Ubuntu:22.04:LTS | pgbouncer | no fix listed | UBUNTU-CVE-2026-6667 |
| Ubuntu:24.04:LTS | pgbouncer | no fix listed | UBUNTU-CVE-2026-6667 |
| Ubuntu:25.10 | pgbouncer | no fix listed | UBUNTU-CVE-2026-6667 |
| Ubuntu:26.04:LTS | pgbouncer | no fix listed | UBUNTU-CVE-2026-6667 |
| Ubuntu:26.10 | pgbouncer | no fix listed | UBUNTU-CVE-2026-6667 |
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L