aiven-open/pghoard · Security
PGHoard: Password written to debug log
- GHSA ID
- GHSA-mpx4-jmpr-vm8v
- CVE ID
- CVE-2026-54711
- Severity
- low
- Published
- Updated
- CVSS v4
- 2.4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Impact
When using .pgpass, database connection information including the username and password will be logged at the debug level.
Patches
Upgrade to version 2.7.1 or greater.
Workarounds
Filter out debug-level logs.
References
This issue was discovered by BugCrowd user DRAKOKORIAN.
CWEs
- CWE-532 · Insertion of Sensitive Information into Log File