Pgpool Global Development Group vulnerabilities and threats

Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.

A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.

CVE-2026-92870 is a stack-based buffer overflow vulnerability in Pgpool-II that can be triggered by an unauthenticated attacker, potentially causing abnormal process termination. The vulnerability affects multiple versions of Pgpool-II from 3.5.0 through 4.7.2. It has a high severity rating with a CVSS score of 7.5, indicating a significant impact on availability but no direct impact on confidentiality or integrity.

CVE-2026-92869 is an out-of-bounds write vulnerability in Pgpool-II that may allow an authenticated attacker to cause abnormal process termination. The vulnerability affects multiple versions of Pgpool-II from 3.5.0 up to 4.7.3 in various subranges. It has a CVSS 3.0 score of 6.5, indicating medium severity. The impact is limited to denial of service via process termination, with no confidentiality or integrity impact reported. There is no explicit patch or remediation information provided in the source data.

CVE-2026-92868 is a medium severity vulnerability in Pgpool-II caused by improper certificate validation. This flaw may allow an unauthenticated attacker to bypass client certificate authentication, potentially compromising the authentication mechanism. The vulnerability affects multiple versions of Pgpool-II from 4.0.0 through 4.7.2. No specific patch or remediation details are provided in the available data.

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.

Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized for the user may be retrieved.

Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series. A specific database user's authentication information may be obtained by another database user. As a result, the information stored in the database may be altered and/or database may be suspended by a remote attacker who successfully logged in the product with the obtained credentials.