CVE-2026-6667

Katalog CVE

CVSS 4.3 · Medium EPSS 0,33%

Kerentanan Missing Authorization pada pgbouncer. Skor CVSS 3.1 4.3 (Medium) menurut CNA.

Deskripsi (NVD)

PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.

Rincian

Terbit di NVD

9 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.pgbouncer.org/changelog.html#pgbouncer-125x release notes