All vulnerabilities
CVE-2026-54711GHSA-mpx4-jmpr-vm8vPYSEC-2026-2872

PGHoard: Password written to debug log

Aiven-Open pghoardPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
2.4Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.

Text from CVE List

Affected versions 11

  • pghoardaffected: < 2.7.1CVE List
  • pghoard, PyPIfrom first release, through 2.1.0OSV
  • pghoard, PyPI1.0.0OSV
  • pghoard, PyPI1.1.0OSV
  • pghoard, PyPI1.2.0OSV
  • pghoard, PyPI1.3.0OSV
  • pghoard, PyPI1.4.0OSV
  • pghoard, PyPI1.5.0OSV
  • pghoard, PyPI1.7.0OSV
  • pghoard, PyPI2.0.0OSV
  • pghoard, PyPI2.1.0OSV

References 2