--- title: PgBouncer patches an auth-bypass CVE, Supabase swallows... description: Security today: PgBouncer 1.26.1 closes a SCRAM auth bypass that let any known password unlock superuser access. Consolidation is the other theme, with... canonical: https://daily.dev/posts/pgbouncer-patches-an-auth-bypass-cve-supabase-swallows-turso-rrfln7fmn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PgBouncer patches an auth-bypass CVE, Supabase swallows Turso | daily.dev og:description: Security today: PgBouncer 1.26.1 closes a SCRAM auth bypass that let any known password unlock superuser access. Consolidation is the other theme, with... og:url: https://daily.dev/posts/pgbouncer-patches-an-auth-bypass-cve-supabase-swallows-turso-rrfln7fmn og:image: https://api.daily.dev/og/posts/rRFLn7fmN.png og:image:alt: PgBouncer patches an auth-bypass CVE, Supabase swallows Turso og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PgBouncer patches an auth-bypass CVE, Supabase swallows Turso **[Databases Digest](https://daily.dev/sources/databases_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary Security today: PgBouncer 1.26.1 closes a SCRAM auth bypass that let any known password unlock superuser access. Consolidation is the other theme, with Supabase acquiring Turso and CedarDB pitching a single engine for OLTP and OLAP. Benchmarks are flying too, from MariaDB's 3.5x throughput fix to Timescale's new pgvector-beating index and a GitHub API rewrite that cut request counts by two orders of magnitude. ## Content **TLDR:** Security today: PgBouncer 1.26.1 closes a SCRAM auth bypass that let any known password unlock superuser access. Consolidation is the other theme, with Supabase acquiring Turso and CedarDB pitching a single engine for OLTP and OLAP. Benchmarks are flying too, from MariaDB's 3.5x throughput fix to Timescale's new pgvector-beating index and a GitHub API rewrite that cut request counts by two orders of magnitude. --- ## PgBouncer 1.26.1 patches a SCRAM authentication bypass and two DoS bugs The scariest bug let a client who knows one SCRAM user's password authenticate as any other SCRAM user, including admins and superusers. Two separate denial-of-service bugs via infinite loops are also fixed, one triggered by an empty startup option name and another by an integer overflow when max_packet_size exceeds its default. If you're running PgBouncer with SCRAM auth, this is not an update to sit on. [Read more](https://daily.dev/posts/3qMEtKalY) ## Supabase acquires Turso, and the hard part starts now Turso cofounder Glauber Costa is joining Supabase as Head of Agentic Services, and the strategic logic is clean on paper: SQLite for small per-agent workloads, Postgres for scale. The real risk is consolidation quietly eroding Turso's independent pricing and community over the next 12-24 months, turning it from a product into a dashboard feature. Worth watching whether Turso keeps shipping independently or starts getting absorbed. [Read more](https://daily.dev/posts/tPJBFpfPk) ## CedarDB pitches one engine for transactions and analytics, backed by €5.3M seed Spun out of the Umbra research project at TU Munich, CedarDB wants to kill the OLTP/OLAP split with a single Postgres-compatible engine, announcing limited availability of CedarDB Cloud at TechCrunch Disrupt. The founders argue Postgres compatibility matters more now because that's what LLMs are trained on. Databricks' June LTAP announcement gets cited as evidence this unified approach has real demand, not just one startup's bet. [Read more](https://daily.dev/posts/dQHDQsB67) ## MariaDB's MDEV-37992 fix recovers a 3.5x throughput cliff A regression that only shows up under specific LRU and buffer-pool conditions with memory-resident workloads was dragging throughput down to 18-19k TPS. Applying the MDEV-33966 fix restored it to 66-68k TPS across the 11.8, 12.3, and 13.1 branches, reproduced on a Hetzner AMD EPYC host with the full TAF properties file and driver commit published for anyone who wants to verify it themselves. [Read more](https://daily.dev/posts/Hx3mZbB7p) --- ## Also notable - **GitHub rebuilds star history to cut react/react's request count from 2,511 to 24:** The new star-history endpoint returns up to 30 weeks of daily counts per request without exposing stargazer identities, closing a phishing-scraping vector while slashing database load for popular repos. [Read more](https://daily.dev/posts/RG99HCIYC) - **Timescale open-sources pg_vectorsearch, claiming it beats pgvector's HNSW and IVFFlat:** The new PRISM index uses a hierarchical centroid tree with RaBitQ quantization and SIMD distance computation, and can index existing pgvector vector/halfvec columns without a rewrite, though it's alpha, requires Postgres 18+, and the speed claims are currently Timescale's own numbers. - **Cloudflare's Hyperdrive MySQL caching bug hit roughly 1 in 100,000 queries:** Caching translated response bytes instead of canonical Hyperdrive-capability bytes caused empty responses or hangs about 0.001% of the time, and fixing it pushed connection success to 99.99% as Hyperdrive MySQL support goes GA. [Read more](https://daily.dev/posts/rHYMSzJrK) - **RDS Postgres snapshot restores run 10-15x slower until EBS hydration finishes:** pg_prewarm in prefetch mode cut that hydration window from over 24 hours passively to around 5 hours, and new StorageOperationStatus and StorageOperationPercentProgress API fields now expose hydration progress directly. [Read more](https://daily.dev/posts/tMicss6i0) - **DumboDB's 0.8 update halves write latency and closes most of the MongoDB performance gap:** Switching Dolt's WAL from fsync to fdatasync plus fairer durability comparisons took zero benchmarks over 5x slower than MongoDB (down from 5) and pushed 49 of 119 benchmarks faster than MongoDB outright. ## Similar posts on daily.dev - [PgBouncer 1.26.1 released - Fixes three CVEs](https://daily.dev/posts/pgbouncer-1-26-1-released---fixes-three-cves-3qmetkaly) · PostgreSQL · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#postgresql](https://daily.dev/tags/postgresql), [#sqlite](https://daily.dev/tags/sqlite), [#supabase](https://daily.dev/tags/supabase) [View this post on daily.dev](https://daily.dev/posts/pgbouncer-patches-an-auth-bypass-cve-supabase-swallows-turso-rrfln7fmn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/pgbouncer-patches-an-auth-bypass-cve-supabase-swallows-turso-rrfln7fmn","headline":"PgBouncer patches an auth-bypass CVE, Supabase swallows Turso","text":"Security today: PgBouncer 1.26.1 closes a SCRAM auth bypass that let any known password unlock superuser access. Consolidation is the other theme, with Supabase acquiring Turso and CedarDB pitching a single engine for OLTP and OLAP. Benchmarks are flying too, from MariaDB's 3.5x throughput fix to Timescale's new pgvector-beating index and a GitHub API rewrite that cut request counts by two orders of magnitude.","url":"https://daily.dev/posts/pgbouncer-patches-an-auth-bypass-cve-supabase-swallows-turso-rrfln7fmn","datePublished":"2026-10-15T04:17:51.735Z","dateModified":"2026-10-15T04:18:12.617Z","author":{"@type":"Organization","name":"Databases Digest","logo":"https://media.daily.dev/image/upload/s--ir1hdV8b--/f_auto,q_auto/v1773839400/logos/databases_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/databases_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/databases_digest","name":"Databases Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Databases Digest","item":"https://daily.dev/sources/databases_digest"},{"@type":"ListItem","position":3,"name":"PgBouncer patches an auth-bypass CVE, Supabase swallows Turso"}]} ```