CVE-2025-46801 Auth bypass in Pgpool-II
Attackers can bypass authentication to log in as arbitrary users, enabling data theft, modification, or database denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46801?
CVE-2025-46801 is a critical authentication bypass vulnerability in Pgpool-II, published on 19 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database.
Weakness: CWE-305
Which versions are affected by CVE-2025-46801?
How do I fix CVE-2025-46801?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-46801 being exploited?
There is no known exploitation of CVE-2025-46801 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-46801, DLA-4334-1, GHSA-9559-hpf7-pqv3, UBUNTU-CVE-2025-46801.