Post

@levelbrook.bsky.social

PgBouncer 1.26.1 fixes three CVEs. The urgent one: under SCRAM auth, a client that knows one user's password could log in as any other SCRAM user, admins included. It also restores ignore_startup_parameters = search_path to 1.25 behaviour. Upgrade the image. #postgresql

15/10/26, 5:01 am0 reposts2 likes

The Projekt

@wearetheprojekt.bsky.social

Shared poolers are where this bites. One PgBouncer in front of five apps means one leaked app password was effectively the admin password until 1.26.1.