{"id":"CVE-2025-22248","aliases":["BIT-pgpool-2025-22248","EUVD-2025-14374","GHSA-mx38-x658-5fwj"],"status":"published","title":"[pgpool] Unauthenticated access to postgres through pgpool","description":"The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00502,"percentile":0.43427,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1188"],"published":"2025-05-13T07:30:00Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Bitnami","package":"pgpool","fixed_in":["4.6.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"pgpool","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.6.0-1"}]}]}],"products":[{"vendor":"broadcom","product":"bitnami"},{"vendor":"broadcom","product":"bitnami\\/pgpool"},{"vendor":"vmware","product":"bitnami"}],"references":[{"url":"https://github.com/bitnami/charts/security/advisories/GHSA-mx38-x658-5fwj","tags":["Vendor Advisory","web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22248.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22248","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-22248","title":"[pgpool] Unauthenticated access to postgres through pgpool","description":"The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.","status":"published","published":"2025-05-13T09:13:30.613Z","modified":"2025-05-13T13:10:31.07Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:32:29.286772Z"}],"euvd":[{"id":"EUVD-2025-14374","description":"The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.","status":"published","published":"2025-05-13T09:13:30Z","modified":"2025-05-13T13:10:31Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T20:32:48.910403Z"}],"nvd":[{"id":"CVE-2025-22248","description":"The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.","status":"published","published":"2025-05-13T10:15:22.6Z","modified":"2026-06-17T08:45:54.693Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:11:07.176032Z"}],"osv":[{"id":"CVE-2025-22248","title":"[pgpool] Unauthenticated access to postgres through pgpool","description":"The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.","status":"published","published":"2025-05-13T09:13:30.613Z","modified":"2026-10-28T02:30:45.789233001Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"BIT-pgpool-2025-22248","description":"The PgPool II component into a Bitnami Pgpool II container image comes by default configured with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. This can be addressed by mounting and overwriting the Pgpool configuration file directly. If PgPool is exposed externally, a potential attacker could use this user to get access to the service.","status":"published","published":"2025-05-13T07:30:00Z","modified":"2025-07-18T05:27:11.177843Z","updated_at":"2026-11-02T15:28:34.343258Z"}]}}