CVE-2026-92868: Pgpool-II Auth Bypass Vulnerability

CVE-2026-92868 Overview

CVE-2026-92868 is an improper certificate validation vulnerability [CWE-295] in Pgpool-II, a middleware that sits between PostgreSQL clients and servers. The flaw allows an unauthenticated remote attacker to bypass client certificate authentication. Pgpool-II performs certificate validation incorrectly, so an attacker who can reach the service over the network may present credentials that should be rejected and still complete authentication.

Critical Impact
An unauthenticated network attacker can bypass client certificate authentication in Pgpool-II, undermining a control that is typically used to gate access to PostgreSQL backends.

Affected Products

Pgpool-II (PostgreSQL connection pooler and middleware)
Deployments relying on client certificate authentication in Pgpool-II
Refer to the PgPool News Update for the specific fixed versions

Discovery Timeline

2026-09-29 - Advisory published by the Pgpool Global Development Group (PgPool News Update)
2026-09-30 - CVE-2026-92868 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-92868

Vulnerability Analysis

Pgpool-II supports TLS-based client authentication, where connecting clients must present an X.509 certificate signed by a trusted certificate authority. This vulnerability breaks that trust boundary. Because Pgpool-II does not fully validate the presented certificate, an attacker without valid credentials can authenticate against the middleware.

The issue is classified as improper certificate validation [CWE-295]. This class of flaw typically involves missing checks on the certificate chain, issuer, subject, or the binding between the certificate and the authenticated identity. See the JVN #22475874 Advisory for coordinated disclosure details.

Root Cause

The root cause lies in how Pgpool-II verifies certificates presented during the TLS handshake for client authentication. The validation logic accepts certificates that should be rejected, meaning the authentication decision does not correctly reflect the certificate's trust state. Refer to the vendor advisory for the specific code paths and fixed versions.

Attack Vector

The attack vector is network-based and requires no prior authentication or user interaction. An attacker who can reach the Pgpool-II listener over the network initiates a TLS connection and presents a crafted or otherwise untrusted client certificate. Because the middleware fails to validate the certificate correctly, the attacker bypasses the client certificate authentication step. Successful exploitation grants access at the level Pgpool-II would normally reserve for authenticated clients, potentially exposing pooled PostgreSQL connections.

// No verified public exploit code is available.
// Refer to the JVN and Pgpool advisories for technical detail.

Detection Methods for CVE-2026-92868

Indicators of Compromise

Successful Pgpool-II authentication events from client IP addresses not previously observed connecting with valid certificates
TLS handshakes accepting client certificates issued by unexpected or untrusted issuers
Pgpool-II session logs showing authenticated sessions without corresponding entries in the client certificate issuance system

Detection Strategies

Enable verbose logging in Pgpool-II and PostgreSQL to capture the distinguished name (DN) and issuer of every client certificate used during authentication
Compare authenticated client certificate DNs and issuers against an allowlist of expected values and alert on mismatches
Monitor for anomalous connection patterns to the Pgpool-II service port from external or unmanaged network segments

Monitoring Recommendations

Forward Pgpool-II and PostgreSQL authentication logs to a centralized log store for retention and correlation
Baseline normal client certificate usage per application and alert on deviations in issuer, subject, or source network
Track TLS handshake failures and successes on the Pgpool-II listener to identify certificate probing activity

How to Mitigate CVE-2026-92868

Immediate Actions Required

Apply the fixed Pgpool-II release listed in the PgPool News Update as soon as it is available for your version branch
Restrict network access to the Pgpool-II listener so that only trusted application subnets can reach it
Audit recent Pgpool-II authentication logs for connections that cannot be tied to a known, issued client certificate

Patch Information

The Pgpool Global Development Group has published fixed versions on the project site. Review the PgPool News Update and JVN #22475874 Advisory for the exact patched versions and upgrade instructions. Upgrade all Pgpool-II instances that rely on client certificate authentication.

Workarounds

Place Pgpool-II behind a network policy that permits connections only from known application hosts until patching is complete
Where feasible, add a defense-in-depth authentication factor at the PostgreSQL backend so that bypassing Pgpool-II authentication alone does not grant database access
Rotate any client certificates and revoke certificates that may have been exposed through the affected middleware

bash

# Example: restrict access to the Pgpool-II port to a trusted subnet
# Replace <PGPOOL_PORT> and <APP_SUBNET> with your values
iptables -A INPUT -p tcp --dport <PGPOOL_PORT> -s <APP_SUBNET> -j ACCEPT
iptables -A INPUT -p tcp --dport <PGPOOL_PORT> -j DROP