CVE-2026-54711

PGHoard: Password written to debug log

State: Published
Severity: 2.4 Low
Published: Oct 23, 2026
Updated: Oct 30, 2026
Reserved: Jun 15, 2026

Description

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.

Scores

CVSS	Score	Vector	Source
4.0	2.4 Low	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-532 Insertion of Sensitive Information into Log File

Affected Products

Product	Versions
pghoardAiven-Open	< 2.7.1Affected

References

https://github.com/Aiven-Open/pghoard/security/advisories/GHSA-mpx4-jmpr-vm8v
https://github.com/Aiven-Open/pghoard/releases/tag/2.7.1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.