Security Advisory

CVE-2026-6667

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-09 00:43:53

Last updated 2026-05-11 14:44:43

Assigner PostgreSQL

CVSS score 4.3

State PUBLISHED

Description

PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.

← Browse all CVEs View on cve.org ↗