PgBouncer Authorization Bypass Vulnerability in KILL_CLIENT Command

An authorization bypass vulnerability has been identified in PgBouncer versions prior to 1.25.2, allowing all users with access to the administration console to execute the KILL_CLIENT command. This command, which terminates client connections, should only be available to users specified in the admin_users parameter. The vulnerability arises from the application's failure to properly restrict access to the command based on user privileges.

Impact

Exploitation of this vulnerability allows unauthorized users to terminate client connections, potentially disrupting active database operations or user activities.

Remediation

Users can upgrade to PgBouncer version 1.25.2 or later, where this vulnerability has been fixed.