CVE-2026-92868: Medium severity Pgpool Pgpool-II vulnerability
Published Sep 30, 2026
·Updated
An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.
Affected Software
1 affected component
Pgpool Pgpool-II
Event History
Sep 30, 2026
CVE Published
via MITRE·07:20 AM
Data Sourced
via MITRE·07:20 AM
DescriptionSeverity
Data Sourced
via NVD·08:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The vulnerability can be exploited by an unauthenticated attacker over the network. No privileges or user interaction are required according to the supplied vector.
2
What security control can be bypassed?
The issue may allow bypass of client certificate authentication because Pgpool-II performs improper certificate validation. Successful exploitation may affect confidentiality and integrity, while no availability impact is indicated.