Description
Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.
Published: 2026-09-30
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

Pgpool-II logs sensitive cluster information, allowing an authenticated attacker to read secrets that should remain confidential. This results in a breach of confidentiality and is described as a Confidentiality Impact under CWE-532. The flaw is defined under CWE-532 (Excessive Logging) and CWE-538 (Log Inadequacy).

Affected Systems

The vulnerability is found in Pgpool-II from Pgpool Global Development Group. No specific version ranges are listed, so all current releases that lack a vendor patch may be affected.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity and the EPSS score is 0.00184, representing a very low probability of exploitation. Because the attacker needs authenticated access it is less likely to be widely exploited and the vulnerability is not listed in CISA's KEV catalog. The most likely exploitation path involves a legitimate user triggering verbose logging and then reviewing the logs to obtain cluster data.

Generated by OpenCVE AI on October 2, 2026 at 01:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Pgpool-II release that removes sensitive data from log files
  • Restrict user permissions to limit who can authenticate to the Pgpool-II cluster
  • Configure logging to suppress sensitive cluster details or apply log filtering

Generated by OpenCVE AI on October 2, 2026 at 01:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Sensitive Information Leak Through Logging in Pgpool-II pgpool-II: pgpool-II: Information disclosure via log files
Weaknesses CWE-538
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

threat_severity

Moderate

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Pgpool Global Development Group
Pgpool Global Development Group pgpool-ii
Vendors & Products Pgpool Global Development Group
Pgpool Global Development Group pgpool-ii

Wed, 30 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Title Sensitive Information Leak Through Logging in Pgpool-II

Wed, 30 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
Description Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.
Weaknesses CWE-532
References
Metrics cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Pgpool Global Development Group Pgpool-ii
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-09-30T16:59:12.573Z

Reserved: 2026-09-17T06:31:54.744Z

Link: CVE-2026-92872

cve-icon Vulnrichment

Updated: 2026-09-30T16:58:42.899Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T08:16:35.347

Modified: 2026-09-30T17:16:51.250

Link: CVE-2026-92872

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-30T07:47:50Z

Links: CVE-2026-92872 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T02:00:14Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File

  • CWE-538

    Insertion of Sensitive Information into Externally-Accessible File or Directory