{"id":"CVE-2026-54711","kind":"vulnerability","aliases":["CVE-2026-54711"],"related":[],"title":"pghoard: debug logs expose PostgreSQL username and password from .pgpass","description":"pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.","summary":"Prior to pghoard 2.7.1, database connection details, including the username and password, are written to logs at debug level when .pgpass is used. An attacker who can read those debug logs gets the database credentials.","severity":"low","cvss":2.4,"epss":0.00164,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backups","package","pghoard","postgresql","self-hosted"],"not_affected_if":["default-config","info-level-logging"],"how_to_check":"- Run `pghoard --version` or check the installed package version; affected if below `2.7.1`\n- Check whether `.pgpass` is used for connections in the pghoard config\n- Check whether debug logging is enabled and whether those logs are readable by others","fix":"- Upgrade pghoard to `2.7.1` or later\n- Rotate the PostgreSQL password if debug logs with credentials may have been stored or shipped elsewhere","status":"open","published_at":"2026-10-23T13:17:09+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:49:37+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:49:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pghoard to `2.7.1` or later\n- Rotate the PostgreSQL password if debug logs with credentials may have been stored or shipped elsewhere","reach":"local","title":"pghoard: debug logs expose PostgreSQL username and password from .pgpass","impact":"low","summary":"Prior to pghoard 2.7.1, database connection details, including the username and password, are written to logs at debug level when .pgpass is used. An attacker who can read those debug logs gets the database credentials.","category":"package","nicknames":[],"who_cares":["pghoard","postgresql","self-hosted","backups"],"confidence":0.7,"needs_auth":"yes","worst_case":"database credentials readable from debug log files","analyst_note":"","how_to_check":"- Run `pghoard --version` or check the installed package version; affected if below `2.7.1`\n- Check whether `.pgpass` is used for connections in the pghoard config\n- Check whether debug logging is enabled and whether those logs are readable by others","needs_analyst":false,"not_affected_if":["default-config","info-level-logging"],"who_is_affected":"Teams running pghoard before 2.7.1 that authenticate to PostgreSQL through a .pgpass file while debug logging is on. Installs that use other authentication methods or keep logging at info level are not exposed by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000581,"input_tokens":3309,"output_tokens":501,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54711':13A,16A '2.7.1':27B,79C,105C 'attack':48B 'backup':17B,63C,70C 'cloud':73C 'connect':29B,84C 'credenti':58B 'cve':11A,14A 'daemon':64C 'data':71C 'databas':28B,57B,83C 'debug':2A,41B,53B,96C 'detail':30B 'expos':4A 'get':55B 'host':23B 'includ':31B,86C 'inform':85C 'issu':99C 'level':42B,97C 'log':3A,39B,54B,93C 'object':74C 'packag':18B 'password':8A,35B,90C 'patch':102C 'pghoard':1A,19B,26B,59C 'pgpass':10A,44B,82C 'postgresql':5A,20B,62C 'prior':24B,76C 'read':51B 'restor':66C 'self':22B 'self-host':21B 'store':69C,75C 'tool':67C 'use':46B,81C 'usernam':6A,33B,88C 'version':78C,104C 'written':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running pghoard before 2.7.1 that authenticate to PostgreSQL through a .pgpass file while debug logging is on. Installs that use other authentication methods or keep logging at info level are not exposed by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54711","severity":null,"published_at":"2026-10-23T13:17:09+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-54711","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54711","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}