Pgpool-II EUVD-2026-89658

Exploitation requires that the Pgpool-II instance be configured to use client TLS certificate authentication (SSL enabled with client certificate verification, e.g. the 'cert' authentication method) - the vulnerability defeats that specific validation, so instances not enforcing client certificates are not exposed to this bypass. The attack is remote and unauthenticated (AV:N/PR:N) with low complexity (AC:L) and no user interaction, but the affected version must fall within the listed ranges (4.0.x-4.2.x, 4.3.0-4.3.20, 4.4.0-4.4.17, 4.5.0-4.5.12, 4.6.0-4.6.7, 4.7.0-4.7.2). The primary limiting factor is the non-default dependency on client-certificate authentication being in use.

This is a moderate-severity authentication-bypass flaw (CVSS 3.0 base 6.5, vendor-scored). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated attack, which is consistent with the description's 'unauthenticated attacker to bypass client certificate authentication.' However, impact is deliberately limited to C:L/I:L/A:N - partial confidentiality and integrity, no availability loss - reflecting that the vulnerability defeats one authentication control (client TLS certificate validation) rather than granting full compromise on its own. No EPSS score, CISA KEV listing, or SSVC decision data was provided, and there is no public exploit identified at time of analysis, so there is no signal of active or imminent mass exploitation. Critically, the flaw is only relevant where Pgpool-II is actually configured to enforce client certificate authentication (the 'cert' auth method / SSL client verification); in deployments not using client certs, this control is not in play. Net assessment: a real but conditional priority for organizations relying on client-certificate authentication in front of PostgreSQL, not a high-CVSS-but-no-real-risk theoretical issue, yet not an emergency given limited impact and no exploitation evidence.

An attacker positioned to reach a Pgpool-II instance that enforces client-certificate authentication presents a connection with an invalid, forged, or otherwise-untrusted client certificate that Pgpool-II fails to validate correctly, and is admitted as if properly authenticated. This lets the attacker bypass the certificate gate and reach the pooled PostgreSQL backend without possessing a legitimate client credential. No public proof-of-concept has been identified at time of analysis; the low attack complexity (AC:L) suggests exploitation would be straightforward once the validation flaw is understood.