CVE-2025-46801

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-19 · updated 2026-06-17
Weakness: CWE-305

Description

Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database.

Affected products

PgPool Global Development Group Pgpool-II: from 4.5.0 through 4.5.6; from 4.4.0 through 4.4.11; from 4.3.0 through 4.3.14; from 4.2.0 through 4.2.21; 4.6.0, All versions of 4.1 series, All versions of 4.0 series

References

https://jvn.jp/en/jp/JVN06238225/
https://www.pgpool.net/mediawiki/index.php/Main_Page#News
https://lists.debian.org/debian-lts-announce/2025/10/msg00014.html

Get alerted when CVE-2025-46801 or the next vulnerability affects your stack