# CVE-2026-92868: Pgpool-II client certificate authentication bypass via NUL byte injection

Source: https://junglewise.ai/threats/cve-2026-92868-an-improper-certificate-validation-vulnerability-exists-in-pgpool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-92868 · Severity: medium · CVSS 6.5 · Published 2026-09-30

Pgpool-II is a middleware that manages PostgreSQL databases in clustered environments, handling connection pooling and failover. A flaw in certificate validation allows attackers to bypass client certificate authentication by injecting NUL bytes into certificate domain names, enabling unauthorized connections as other users without passwords.

Technologies: [Pgpool Global Development Group Pgpool-II](https://junglewise.ai/threats/technologies/pgpool-ii). Vendors: [Pgpool Global Development Group](https://junglewise.ai/threats/vendors/pgpool-global-development-group).

## Quick answers

**Is CVE-2026-92868 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92868 being exploited in the wild.

**How severe is CVE-2026-92868?** Medium severity, with a CVSS score of 6.5, published 30 September 2026.

**Which products and versions are affected?** Pgpool Global Development Group Pgpool-II 4.0.x through 4.7.2.

**Is there a fix for CVE-2026-92868?** A patch was published on 2026-09-29: Fixed in versions 4.7.3, 4.6.8, 4.5.13, 4.4.18, 4.3.21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92868 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-92868?** Check whether you run Pgpool Global Development Group Pgpool-II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Pgpool-II improperly handles NUL bytes (\0) in the Common Name (CN) field of X.509 certificates during client authentication, allowing domain name validation to be bypassed. An unauthenticated attacker can craft a malicious certificate to authenticate as another user without providing credentials. The vulnerability affects versions 4.0.x through 4.7.2 and requires network access but no prior authentication.

## Affected products

- Pgpool Global Development Group Pgpool-II 4.0.x through 4.7.2

## Timeline

- 2026-09-29: disclosed
- 2026-09-29: patched: Fixed in versions 4.7.3, 4.6.8, 4.5.13, 4.4.18, 4.3.21

## References

- [https://jvn.jp/en/jp/JVN22475874/](https://jvn.jp/en/jp/JVN22475874/)
- [https://pgpool.net/news/2026-09-29/](https://pgpool.net/news/2026-09-29/)

## Related threats

- [Pgpool-II authentication bypass in watchdog promotion](https://junglewise.ai/threats/cve-2026-92873-pgpool-ii-contains-an-incorrect-implementation-of-an)
- [Pgpool-II sensitive information insertion into log file](https://junglewise.ai/threats/cve-2026-92872-pgpool-ii-inserts-sensitive-information-into-log-file-which-may)
- [Pgpool-II NULL pointer dereference in watchdog](https://junglewise.ai/threats/cve-2026-92871-a-null-pointer-dereference-vulnerability-exists-in-pgpool-ii)
- [Pgpool-II stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-92870-a-stack-based-buffer-overflow-vulnerability-exists-in-pgpool-ii)
- [Pgpool-II out-of-bounds write in watchdog message processing](https://junglewise.ai/threats/cve-2026-92869-an-out-of-bounds-write-vulnerability-exists-in-pgpool-ii-which)