Pgpool-II, a middleware that works between PostgreSQL servers and clients, has a vulnerability identified as CVE-2026-92872 where sensitive information is written into log files. This could enable an authenticated attacker to obtain cluster information by accessing these logs. The vulnerability affects a broad range of versions including all versions prior to 3.5.0 and versions from 3.5.0 through 4.7.2 inclusive. The CVSS 3.0 base score is 4.3, indicating medium severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction. There is no indication of an official patch or vendor advisory specifying remediation.

An authenticated attacker may gain access to sensitive cluster information by reading log files containing this data. This could potentially aid in further attacks or reconnaissance but does not directly impact confidentiality, integrity, or availability beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to log files to authorized users only to prevent unauthorized reading of sensitive information.