EUVD-2026-89676
GHSA-84mj-xfmv-f82h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege authenticated access
-
ExploitTrigger or await logging of cluster data
-
ExecutionRead Pgpool-II log file
-
ImpactHarvest exposed cluster information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log data sanitization
|
| Exploitation Conditions | Requires (1) a valid low-privilege authenticated account (PR:L) in the Pgpool-II environment, and (2) read access to the Pgpool-II log file(s) into which sensitive cluster information is written. Exploitation is limited to disclosure of cluster configuration/topology information (C:L) - no write, integrity, or availability impact. The advisory does not name a specific non-default configuration toggle, so the logging behavior appears to occur in normal operation; confirm the exact log destination and exposed fields against the pgpool.net/JVN advisory. The practical limiter is access to the log store, which in hardened deployments is restricted to administrators. |
| Impact | This is a low-to-moderate priority information-disclosure issue, not a critical one. The vendor CVSS:3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) is internally consistent with the description: an already-authenticated attacker (PR:L) reads sensitive cluster information written into log files (C:L only, no integrity or availability impact). The value of the leak is bounded - it exposes cluster/configuration information via CWE-532 log insertion, not credentials-guaranteed or code execution. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no signal of active or automated exploitation; the SSVC framework was not supplied. The realistic prerequisite is that the attacker already holds a valid low-privilege account AND has read access to the Pgpool-II log files/output, which materially limits reach. Net: a genuine defense-in-depth/hardening fix worth patching in normal cycles, but not an emergency. One caveat: the description does not specify exactly WHICH log destination or which sensitive fields are exposed - verify against the vendor advisory (pgpool.net 2026-09-29 / JVN JVN22475874) before scoping. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on or adjacent to a Pgpool-II deployment reads the middleware's log files, where Pgpool-II has recorded sensitive cluster information (e.g., backend/node configuration details). The attacker harvests this leaked cluster topology/configuration to inform further attacks against the PostgreSQL backends. No public exploit code was identified at time of analysis, and exploitation yields only information disclosure (C:L), not code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Pgpool-II writes sensitive cluster configuration and topology information into its log files, allowing an authenticated attacker who can read those logs to learn details about the PostgreSQL cluster. Exploitation requires a valid low-privilege account (CVSS vector PR:L, network reachable) plus read access to the log store, and the resulting impact is limited to confidentiality (C:L) with no integrity or availability effect. No public exploit code has been identified at time of analysis, and this rates as a low-to-moderate priority information-disclosure issue rather than a critical one.
RemediationAI
No vendor-released patch version was identified in the available intelligence, so consult the advisories at https://pgpool.net/news/2026-09-29/ and https://jvn.jp/en/jp/JVN22475874/ for the authoritative fix level and apply the vendor-recommended upgrade as soon as it is published. In the interim, the decisive control is restricting who can read the logs: set the Pgpool-II log file (and any rotated copies) to administrator-only permissions (for example chmod 600/640 with ownership by the pgpool service account or root), and apply the same restriction to log directories and logrotate configuration - the trade-off is that ordinary operators and support staff lose the ability to self-service troubleshooting and must escalate through an administrator. If logs are shipped to a central syslog/ELK-style collector, enforce per-source access control and exclude or mask the Pgpool-II log stream from broadly readable indexes, accepting degraded correlation visibility across teams. Where verbosity is configurable, lower the Pgpool-II log level (away from debug/verbose settings) to reduce the volume of cluster detail written, noting that this can hamper incident forensics and performance diagnosis. Finally, verify with the advisory whether the exposed fields can be filtered or whether the log destination must be changed, and monitor log stores for unauthorized read access; none of these measures remove the underlying CWE-532 logging behavior, so they are compensations only until a patched Pgpool-II release is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pgpool-II is a PostgreSQL middleware/proxy that sits between database clients and backends, providing connection pooling, load balancing, replication management and watchdog clustering; because it must track node topology, backend connection strings and authentication state, its normal operational logging can capture cluster-level details. The root cause is CWE-532 (Insertion of Sensitive Information into Log File): the product emits data to its log output without redaction or access restriction, so anyone able to read the log destination inherits visibility into that data. The CPE string (cpe:2.3:a:pgpool_global_development_group:pgpool-ii:*:*:*:*:*:*:*:*) uses a wildcard version, indicating the vendor has not scoped the flaw to a single release line, and the advisory does not name a non-default configuration toggle, so the exposure appears to arise from ordinary logging behavior rather than an opt-in debug mode. The practical security boundary is therefore not the network path (AV:N) but the file-system or log-aggregation permissions protecting the log destination; in hardened deployments where logs are root/administrator-only, the residual risk is small, while shared or world-readable log paths materially raise exposure. This is an information-disclosure condition only - there is no injection, memory-safety or privilege-escalation primitive described, which is consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Know when Pgpool Ii gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated low-privilege attacker (PR:L) reads sensitive cluster data logged by the service; confidentiality-only low impact, no integrity/availability effect, no scope change.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
1DescriptionCVE.org
Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
NULL pointer dereference in Pgpool-II allows an unauthenticated remote attacker to crash the watchdog process when the h
Stack-based buffer overflow in Pgpool-II (versions 3.5.x through 4.7.2) allows unauthenticated remote attackers to crash
An out-of-bounds write (CWE-787) in Pgpool-II, the PostgreSQL connection pooler, allows an authenticated attacker who al
An out-of-bounds write in the Pgpool-II connection pooling and load-balancing middleware allows an authenticated remote
Pgpool-II deployments that run in watchdog-based high-availability clustering mode can have an arbitrary watchdog node p
Client certificate authentication in Pgpool-II can be bypassed by a remote unauthenticated attacker because affected ver
Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0
Exploit-DB