An improper certificate validation vulnerability exists in Pgpool-II, a connection pooler for PostgreSQL, which may allow an unauthenticated attacker to bypass client certificate authentication mechanisms. This could lead to unauthorized access or actions that rely on client certificate validation. The vulnerability affects multiple versions of Pgpool-II, specifically versions from 4.0.x up to and including 4.7.2 in various subversions. The CVSS 3.0 score is 6.5 (medium severity), with attack vector network, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. There is no vendor advisory or patch information provided in the input data.

The vulnerability allows bypassing client certificate authentication, which can lead to unauthorized access to Pgpool-II services that rely on client certificates for authentication. This compromises the confidentiality and integrity of the system but does not affect availability. Since the attacker does not require authentication or user interaction, the risk is elevated but limited by the medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider implementing additional access controls or network-level restrictions to limit exposure of Pgpool-II services requiring client certificate authentication.