GitHub Advisoryadvisory · PyPI

GHSA-xmfj-7pp5-fxr6 Llama Stack exposes secret in initialization log

LOW Published 2026-01-30 Modified 2026-01-30 Official page ↗

Aliases: CVE-2026-25211
Ecosystem: PyPI
Packages: llama-stack
Severity: Low
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weaknesses: CWE-532
Reviewed: 2026-01-30

Affected packages

• PyPI llama-stack: < 0.4.4 → fixed in 0.4.4

Description

Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.

Related

Alias · CVE (1)

CVE-2026-25211 Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log. vulnerability

Weakness · CWE (1)

CWE-532 Insertion of Sensitive Information into Log File weakness

References