Read the docs
TI-2026-79608 Aliases CVE-2026-54711

PGHoard writes database passwords to debug log

Priority LOW 11CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

Aiven-Open pghoard before 2.7.1 and the PyPI pghoard package through 2.1.0 are affected. When .pgpass is used, pghoard logs database connection information, including the username and password, at the debug level, which is an instance of CWE-532. A local user with high privileges and some user interaction can read the credentials from the debug log.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00156 4th percentileScored 2026-11-07
Fix Fixed pghoard (Aiven-Open): 2.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Aiven-Openpghoardbefore 2.7.12.7.1Patch availableCNA
—pghoard (PyPI)up to 2.1.0—No fix listedGHSA-mpx4-jmpr-vm8v
  • pghoard VendorAiven-Open Affected before 2.7.1 Fixed in 2.7.1 Patch available CNA
  • pghoard (PyPI) Vendor— Affected up to 2.1.0 Fixed in — No fix listed GHSA-mpx4-jmpr-vm8v

Remediation

Upgrade Aiven-Open pghoard to version 2.7.1. The PyPI pghoard package has no fixed version listed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA pghoard (Aiven-Open) Fixed in 2.7.1

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-54711
  2. 2026-10-30 CISA SSVC decision points changed

References

Other 3

  • TI-2025-38105 Karapace is vulnerable to Authentication Bypass CVSS 3.1HIGH 8.6
  • TI-2025-34940 aiven-db-migrate allows Privilege Escalation through use of psql during migration CVSS 3.1CRITICAL 9.1
  • TI-2025-22661 aiven-extras allows PostgreSQL Privilege Escalation through format function CVSS 3.1CRITICAL 9.1
  • TI-2025-34939 aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migration CVSS 3.1CRITICAL 9.1
  • TI-2026-79625 Path traversal in PGHoard restore allows arbitrary file writes CVSS 3.1HIGH 8.4
  • TI-2023-15599 aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path CVSS 3.1HIGH 8.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences