GitHub Advisoryadvisory · PyPI

GHSA-mpx4-jmpr-vm8v PGHoard: Password written to debug log

LOW Published 2026-06-18 Modified 2026-06-18 Official page ↗
Aliases
CVE-2026-54711
Ecosystem
PyPI
Packages
pghoard
Severity
Low
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-532
Reviewed
2026-06-18

Affected packages

• PyPI pghoard: <= 2.1.0 (no fix yet)

Description

Impact When using .pgpass, database connection information including the username and password will be logged at the debug level. Patches Upgrade to version 2.7.1 or greater. Workarounds Filter out debug-level logs. References This issue was discovered by BugCrowd user DRAKOKORIAN.

Related

Alias · CVE (1)

  • CVE-2026-54711 pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References