A critical vulnerability in PgBouncer allows authenticated attackers to perform arbitrary SQL execution, posing a significant risk to database integrity and confidentiality.

This flaw stems from an untrusted search path within the auth_query connection handler. An attacker with low-level privileges can manipulate the search_path parameter in a StartupMessage to execute arbitrary SQL commands during the authentication phase.

The ability to execute arbitrary SQL commands against a database proxy can lead to unauthorized data access, modification, or complete compromise of the backend database. Given the CVSS score of 7.5, this high-severity flaw represents a major risk to business operations, potentially resulting in data breaches or the bypass of essential security controls.

Immediate Action: Upgrade all instances of PgBouncer to version 1.25.1 or later to resolve the underlying search path vulnerability.

Proactive Monitoring: Review database authentication logs for unusual StartupMessage patterns or unexpected SQL query activity originating from the PgBouncer connection handler.

Compensating Controls: Ensure that the database user configured for the auth_query has the minimum possible privileges required, strictly limiting the potential impact if an injection occurs.

Public Exploit Available: No (exploit_available: unknown)

The risk associated with this vulnerability is significant due to the potential for direct database interaction through a trusted proxy component. Security teams must prioritize patching PgBouncer to version 1.25.1 to eliminate the injection path and protect backend data assets from unauthorized manipulation.