CVE-2025-22248: Bitnami Pgpool II Unauthenticated Database Access Vulnerability
Summary
CVE-2025-22248: The PgPool II component into a Bitnami Pgpool II container image comes by default configured with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. Affects pgpool versions < 4.6.0-1. Fixed in 4.6.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PgPool II is a middleware that works between PostgreSQL database servers and their clients. It provides connection pooling, load balancing, and replication features, enhancing database performance and reliability. However, a default configuration in the Bitnami Pgpool II container image exposes a significant security risk by allowing unauthenticated access to the database through a 'repmgr' user.
Vulnerability Detail
The vulnerability arises from the default configuration of the PgPool II component in the Bitnami Pgpool II container image, which includes an 'repmgr' user that permits unauthenticated access to the database within the cluster. If PgPool is exposed to external networks, an attacker could exploit this vulnerability to gain unauthorized access to the database service, potentially leading to data breaches or service disruptions.
How To Fix
Minimum fixed version
4.6.0-1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can mount and overwrite the Pgpool configuration file directly to disable the 'repmgr' user. This can be done by creating a custom configuration file and using the following command: 'docker run -v /path/to/custom_pgpool.conf:/opt/bitnami/pgpool/conf/pgpool.conf bitnami/pgpool'.
Conclusion
CVE-2025-22248 presents a critical vulnerability in the Bitnami Pgpool II container image, allowing unauthenticated access to the database. It is crucial to update to the patched version and implement security best practices to mitigate risks.
See every vulnerability recorded for pgpool →
FAQ
The impact includes unauthorized access to the database, which could lead to data breaches or service disruptions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement the workaround by securing the Pgpool configuration to disable the 'repmgr' user.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Best practices include regularly updating to the latest versions, configuring strong authentication methods, and restricting access to trusted networks.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgpool.
