Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
pgbouncer in Red Hat hardened images can grant higher privileges
published today
Summary
The pgbouncer component included in Red Hat’s hardened container images had a flaw that could let a malicious user gain more rights than intended. This could let attackers move from a limited role to a more powerful one inside the container. Apply the latest Red Hat update to the pgbouncer package to correct the issue.
What to do
- Update redhat pgbouncer to version 0:1.26.1-1.hum1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:hummingbird:1 | redhat | pgbouncer |
< 0:1.26.1-1.hum1 Fix: upgrade to 0:1.26.1-1.hum1
|
Original advisory text
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
References
- https://access.redhat.com/errata/RHSA-2026:83843 Vendor Advisory
- https://images.redhat.com/ Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-107348 Third Party Advisory
- https://access.redhat.com/security/updates/classification/ Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-107349 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-107350 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83843.... Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2552741 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-107348 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-107348 Vendor Advisory
- https://www.pgbouncer.org/changelog.html Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2552735 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-107349 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-107349 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2552733 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-107350 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-107350 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Sources
RHSA-2026:83843 · OSV
Track software like this
Free during beta