Pgpool-II: seven vulnerabilities and how we locked down our clients in 48 hours.
An authentication bypass, memory corruption and information leaks in the most widely used load balancer in front of PostgreSQL. Here is what happened, what we did and what you should do today.
29 Sep 2026Custodia Research6 min read
Fixed versions
Upgrade to the fixed release of your branch. Earlier versions in each branch are vulnerable.
- 4.7.3
- 4.6.8
- 4.5.13
- 4.4.18
- 4.3.21
What was found
- Authentication01
X.509 certificate bypass
Pgpool-II did not correctly handle NUL bytes in the Common Name field of client certificates. A crafted certificate could impersonate another user and reach the database.
- High availability02
Watchdog takeover
The watchdog authentication key could be bypassed to promote an arbitrary node to leader, redirecting cluster traffic.
- Memory03
Out-of-bounds writes
Several out-of-bounds writes and stack corruption bugs that, in the worst case, can lead to crashes or code execution.
- Information04
Leak via the watchdog
The watchdog process could disclose internal information to anyone able to reach its port.
Our response, hour by hour
- H+0
Advisory published
Our intelligence team picks it up and opens an internal incident.
- H+2
Inventory
We identify every Pgpool-II instance across client infrastructure and its exposure.
- H+6
Mitigation
We restrict the watchdog port, harden certificate authentication and ship new SOC detections.
- H+48
Patched
All instances upgraded to fixed versions and verified, with zero downtime.
- to patch every client
- < 48 h
- to patch every client
- service outages during the upgrade
- 0
- service outages during the upgrade
- successful exploitation attempts
- 0
- successful exploitation attempts
What to do today
- 1Upgrade Pgpool-II to the fixed release for your branch.
- 2Never expose the watchdog port outside the cluster network.
- 3Review certificate authentication logs from recent weeks.
- 4Rotate watchdog keys and service credentials.
- 5If you think you were attacked, call our emergency line.
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.