CVE-2025-2291
📋 TL;DR
This vulnerability in PgBouncer allows attackers to authenticate with expired passwords when using auth_query mode. The connection pooler fails to check PostgreSQL's VALID UNTIL password expiration values, bypassing password lifecycle controls. Organizations using PgBouncer with auth_query authentication are affected.
💻 Affected Systems
- PgBouncer
📦 What is this software?
Pgbouncer by Pgbouncer
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized database access with expired credentials, potentially leading to data theft, privilege escalation, or lateral movement within database infrastructure.
Likely Case
Users with expired passwords maintain access beyond intended expiration, violating security policies and audit requirements.
If Mitigated
With proper network segmentation and monitoring, impact is limited to authentication policy violations without data compromise.
🎯 Exploit Status
Exploitation requires knowledge of expired credentials. No authentication bypass - attacker must possess valid but expired password.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PgBouncer 1.24.0 and later
Vendor Advisory: https://www.pgbouncer.org/changelog.html#pgbouncer-124x
Restart Required: Yes
Instructions:
1. Download PgBouncer 1.24.0 or newer from official sources. 2. Stop PgBouncer service. 3. Install updated version. 4. Restart PgBouncer service. 5. Verify functionality.
🔧 Temporary Workarounds
Disable auth_query mode
allSwitch to alternative authentication methods like auth_file or auth_hba that don't have this vulnerability
Modify pgbouncer.ini: set auth_type = auth_file or auth_hba
Restart PgBouncer: systemctl restart pgbouncer
Enforce password rotation at application layer
allImplement additional password expiration checks in application code
🧯 If You Can't Patch
- Implement network segmentation to restrict PgBouncer access to trusted hosts only
- Enable comprehensive logging and monitoring for authentication attempts with expired credentials
🔍 How to Verify
Check if Vulnerable:
Check PgBouncer version and auth_query configuration: pgbouncer --version and review pgbouncer.ini for auth_type = auth_queryCheck Version:
pgbouncer --versionVerify Fix Applied:
Confirm version is 1.24.0+: pgbouncer --version | grep -E '1\.2[4-9]|1\.[3-9]'📡 Detection & Monitoring
Log Indicators:
- Authentication attempts with expired passwords in PgBouncer logs
- Successful connections after password expiration dates
Network Indicators:
- Database connections from unexpected sources after password rotation
SIEM Query:
source="pgbouncer.log" AND ("auth_query" OR "authentication") AND ("expired" OR "valid until")