CVE-2025-22248: Unauthenticated Access in Bitnami pgpool and postgres-ha

Critical Vulnerability Information Vulnerability Overview Title: [pgpool] Unauthenticated access to postgres through pgpool Severity: Critical (CVSS v4: 9.4/10) CVE ID: CVE-2025-22248 Affected Packages and Versions bitnami/pgpool (Docker): - Affected Versions: - Fixed Version: 4.6.0-debian-12-r8 bitnami/postgres-ha (Helm): - Affected Versions: - Fixed Version: 16.0.0 Description Summary: - The bitnami/pgpool Docker image and bitnami/postgres-ha Kubernetes Helm chart, by default, include a 'repmgr' user that allows unauthenticated access to databases within the cluster. Details: - PGPOOL_SR_CHECK_USER is the user in Pgpool used to perform streaming replication checks and should not be granted trust privileges. This allows the repmgr user to log in to the PostgreSQL database without authentication. If Pgpool is exposed externally, an attacker could exploit this user to gain access to the service. This issue also affects the bitnami/postgres-ha Kubernetes Helm chart. Remediation Recommended Actions: - Upgrade Pgpool II to version 4.6.0-1 (container image 4.6.0-debian-12-r8) or later. - For Helm charts, upgrade to version 16.0.0 or later. CVSS v4 Base Metrics Exploitability Metrics: - Attack Vector: Adjacent - Attack Complexity: Low - Attack Requirements: None - Required Privileges: None - User Interaction: None Primary System Impact Metrics: - Confidentiality: High - Integrity: High - Availability: High Secondary System Impact Metrics: - Confidentiality: High - Integrity: High - Availability: High

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-22248: Unauthenticated Access in Bitnami pgpool and postgres-ha

More from this source