Live › vulnerability › CVE-2026-54711
Go to dashboardPrior to pghoard 2.7.1, database connection details, including the username and password, are written to logs at debug level when .pgpass is used. An attacker who can read those debug logs gets the database credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running pghoard before 2.7.1 that authenticate to PostgreSQL through a .pgpass file while debug logging is on. Installs that use other authentication methods or keep logging at info level are not exposed by this description.
No product ranges from the sources yet.
pghoard --version or check the installed package version; affected if below 2.7.1.pgpass is used for connections in the pghoard config2.7.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-54711")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.