CVE-2026-92873
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an...
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
- Record
CVE-2026-92873- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-303
- Updated
- 2026-11-02
EUVDEUVD-2026-89677
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
- Record
EUVD-2026-89677- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pxg9-2v62-434q
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an...
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
- Record
GHSA-pxg9-2v62-434q- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-303
- Updated
- 2026-11-02
NVD
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
- Record
CVE-2026-92873- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-303
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-92873
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
- Record
DEBIAN-CVE-2026-92873- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pgpool2Debian:12 |
All versions, plus listed versions 4.3.5-14.3.5-1+deb12u14.3.5-24.3.5-34.3.7-1 Show 23 moreShow less4.3.7-1.1~exp14.3.7-24.5.2-14.5.4-14.5.4-24.5.4-34.5.5-14.6.0-14.6.0-24.6.1-14.6.1-24.6.2-14.6.3-14.6.3-24.6.3-34.6.3-44.6.4-14.6.5-14.7.0-14.7.1-14.7.2-14.7.2-24.7.3-1 |
None known |
pgpool2Debian:13 |
All versions, plus listed versions 4.6.1-24.6.2-14.6.3-14.6.3-24.6.3-3 Show 8 moreShow less4.6.3-44.6.4-14.6.5-14.7.0-14.7.1-14.7.2-14.7.2-24.7.3-1 |
None known |
pgpool2Debian:14 |
before 4.7.3-1, plus listed versions 4.6.1-24.6.2-14.6.3-14.6.3-24.6.3-3 Show 7 moreShow less4.6.3-44.6.4-14.6.5-14.7.0-14.7.1-14.7.2-14.7.2-2 |
4.7.3-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-92873 is a medium vulnerability (CVSS 6.9) in Pgpool Global Development Group Pgpool-ii, published September 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in pgpool2 4.7.3-1.