CVE-2025-12819: PgBouncer SQL Injection Vulnerability

CVE-2025-12819 Overview

CVE-2025-12819 is an untrusted search path vulnerability in the auth_query connection handler in PgBouncer before version 1.25.1. This security flaw allows an unauthenticated attacker to execute arbitrary SQL during the authentication phase by injecting a malicious search_path parameter within the StartupMessage. The vulnerability is classified under CWE-426 (Untrusted Search Path), which occurs when an application uses a search path that includes directories or locations that could be controlled by malicious actors.

PgBouncer is a lightweight connection pooler for PostgreSQL, commonly deployed in production environments to improve database performance and manage connection limits. Given its position as a gateway between applications and PostgreSQL databases, vulnerabilities in PgBouncer can have significant security implications for the entire database infrastructure.

Critical Impact

Unauthenticated attackers can execute arbitrary SQL commands during the authentication process, potentially leading to data exfiltration, privilege escalation, or complete database compromise without valid credentials.

Affected Products

• PgBouncer versions prior to 1.25.1

Discovery Timeline

• 2025-12-03 - CVE-2025-12819 published to NVD
• 2025-12-27 - Last updated in NVD database

Technical Details for CVE-2025-12819

Vulnerability Analysis

This vulnerability resides in PgBouncer's authentication mechanism, specifically within the auth_query connection handler. PgBouncer uses the auth_query feature to delegate authentication decisions to the backend PostgreSQL database by executing a configured SQL query. The flaw allows an attacker to manipulate the search_path parameter in the PostgreSQL StartupMessage, which is the initial protocol message sent when establishing a connection.

By controlling the search_path, an attacker can influence which schema PostgreSQL searches first when resolving function or object names. If the auth_query uses unqualified function names (functions without explicit schema prefixes), an attacker could create malicious functions in a schema they control that would be executed instead of the intended authentication functions.

Root Cause

The root cause is improper handling of untrusted input in the StartupMessage processing logic. PgBouncer fails to sanitize or restrict the search_path connection parameter before forwarding authentication requests to the backend PostgreSQL server. This allows attackers to inject arbitrary schema paths that get processed during the authentication query execution, enabling schema injection attacks where malicious functions can shadow legitimate database functions.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Initiating a connection to the PgBouncer instance
2. Crafting a malicious StartupMessage containing a specially crafted search_path parameter
3. The search_path points to an attacker-controlled schema containing malicious functions
4. When PgBouncer executes the auth_query, PostgreSQL resolves function names using the malicious search path
5. Attacker's malicious functions execute instead of legitimate authentication functions

The vulnerability mechanism involves manipulating the PostgreSQL StartupMessage protocol to include a malicious search_path parameter. When PgBouncer forwards the authentication query to the backend database, PostgreSQL uses this attacker-controlled search path to resolve object names, allowing arbitrary SQL execution during authentication. For detailed technical information, refer to the PgBouncer Changelog.

Detection Methods for CVE-2025-12819

Indicators of Compromise

• Unusual search_path values in PostgreSQL connection logs containing non-standard or unexpected schema names
• Authentication attempts with suspicious StartupMessage parameters from external IP addresses
• Creation of new schemas or functions in the PostgreSQL database that mirror authentication-related function names
• Failed authentication events followed by successful database queries from the same source

Detection Strategies

• Monitor PgBouncer logs for connections with non-default search_path parameters in the startup phase
• Implement network intrusion detection rules to identify anomalous PostgreSQL wire protocol messages
• Enable detailed PostgreSQL logging (log_statement = 'all') to capture unexpected SQL execution during authentication
• Deploy SentinelOne agents to detect suspicious process behavior and network activity associated with database exploitation

Monitoring Recommendations

• Configure alerting for any modifications to PostgreSQL schemas that could be used for search path hijacking
• Establish baseline connection patterns and alert on deviations in StartupMessage parameters
• Implement real-time monitoring of database authentication events with correlation to application-level authentication logs
• Review PgBouncer configuration regularly to ensure auth_query uses fully qualified function names

How to Mitigate CVE-2025-12819

Immediate Actions Required

• Upgrade PgBouncer to version 1.25.1 or later immediately
• Review and audit auth_query configurations to ensure they use fully schema-qualified function names (e.g., pg_catalog.function_name)
• Restrict network access to PgBouncer instances using firewalls and security groups
• Enable connection logging and monitor for suspicious authentication patterns

Patch Information

The PgBouncer development team has released version 1.25.1 which addresses this vulnerability. Security updates are also available through distribution channels including Debian. Refer to the PgBouncer Changelog 1.25.x for detailed release notes. Debian users should consult the Debian LTS Announcement for package update information.

Workarounds

• Modify auth_query to use fully qualified function names with explicit schema prefixes to prevent search path manipulation
• Implement network segmentation to limit access to PgBouncer instances only from trusted application servers
• Configure PostgreSQL to restrict schema creation and function deployment privileges for non-administrative users
• Consider using client certificate authentication instead of password-based authentication via auth_query

# Configuration example - Update auth_query to use fully qualified function names
# In pgbouncer.ini, change:
# auth_query = SELECT usename, passwd FROM pg_shadow WHERE usename=$1
# To use fully qualified references:
auth_query = SELECT usename, passwd FROM pg_catalog.pg_shadow WHERE usename=$1