CVE-2026-92868
MediumCVSS 6.5Summary
An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.
Risk Assessment
The risk involves potential unauthorized access to the system by attackers without a valid certificate, which could lead to security breaches.
Recommendation
It is recommended to update Pgpool-II to the latest version and enforce strict certificate validation.
Other vulnerabilities in Pgpool-II
See all- CVE-2026-92873High
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
- CVE-2026-92872Medium
Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.
- CVE-2026-92871High
A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.
- CVE-2026-92870High
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.
- CVE-2026-92869Medium
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.
- CVE-2026-92867High
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.
Original NVD description (English source)
An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS