CVE-2025-22248

The 'repmgr' user (PGPOOL_SR_CHECK_USER) is used by Pgpool to perform streaming replication checks between cluster nodes. In the default configuration, this account operates at the 'trust' authentication level, meaning that a connection to the database using this user does not require a password. An attacker gaining network access to the Pgpool instance can log in to the PostgreSQL database as 'repmgr' without any credentials. The issue affects both the bitnami/pgpool Docker image and the bitnami/postgres-ha Helm chart for Kubernetes.

An attacker can gain unauthorized access to the PostgreSQL database running inside the cluster, which if Pgpool is exposed externally can lead to data reading, modification, or deletion. Due to the high CVSS score, compromise of system and network resources beyond the direct scope of the database is also possible.

Apply patches available from the vendor according to the references provided. Additionally, immediately change the authentication configuration of the 'repmgr' user (PGPOOL_SR_CHECK_USER) from 'trust' level to a password-requiring mechanism (e.g., 'md5' or 'scram-sha-256') and restrict network access to Pgpool only to trusted sources within the cluster.

The bitnami/pgpool Docker image and bitnami/postgres-ha Kubernetes Helm chart running in default configuration; specific versions indicated in the vendor's references