Executive brief
PgBouncer, a popular connection pooler for PostgreSQL databases, contains a security flaw where the 'KILL_CLIENT' administrative command does not properly verify user permissions. This allows any user who has basic access to the administration console to forcibly disconnect other database clients, potentially causing service disruptions. While an attacker must already have authorized access to the admin console to exploit this, they could interfere with legitimate database operations and availability.
Technical details
A missing authorization check (CWE-862) exists in PgBouncer's administration console regarding the 'KILL_CLIENT' command. While access to the administration console itself requires authentication, the software failed to restrict the 'KILL_CLIENT' command specifically to users defined in the 'admin_users' configuration parameter. Consequently, any authenticated user with access to the console (including those only intended to have read-only 'stats_users' access) can execute this command to terminate active client connections. This results in a partial loss of availability. The issue is resolved in version 1.25.2 by enforcing that only 'admin_users' can execute the command.
Affected products
- PostgreSQL PgBouncer before 1.25.2
Timeline
- 2026-05-08: patched: Fixed in PgBouncer version 1.25.2
- 2026-05-09: disclosed: CVE-2026-6667 published