Authentication Algorithm Flaw in Pgpool-II Allows Elevation of Privilege
CVE-2026-92873

6.9MEDIUM

Key Information:

Vendor

Pgpool Global Development Group

Status
Pgpool-ii
Vendor
CVE Published:
30 September 2026

What is CVE-2026-92873?

The vulnerability in Pgpool-II arises from an incorrect implementation of its authentication algorithm. This flaw allows an unauthenticated attacker to promote any arbitrary watchdog node to the leader node, posing a significant risk of unauthorized access and control over the system's operations. As such, compromised nodes could manipulate data and configurations, leading to potential security breaches. Users are encouraged to update to the latest version to mitigate this vulnerability.

Affected Version(s)

Pgpool-II 4.7.0 <= 4.7.2

Pgpool-II 4.6.0 <= 4.6.7

Pgpool-II 4.5.0 <= 4.5.12

References

https://pgpool.net/news/2026-09-29/
https://jvn.jp/en/jp/JVN22475874/

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.