---
id: "CVE-2026-54711"
kind: "vulnerability"
aliases: ["CVE-2026-54711"]
title: "pghoard: debug logs expose PostgreSQL username and password from .pgpass"
severity: "low"
cvss: 2.4
epss: 0.00164
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["backups", "package", "pghoard", "postgresql", "self-hosted"]
not_affected_if: ["default-config", "info-level-logging"]
published_at: "2026-10-23T13:17:09+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54711", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-54711", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# pghoard: debug logs expose PostgreSQL username and password from .pgpass

Prior to pghoard 2.7.1, database connection details, including the username and password, are written to logs at debug level when .pgpass is used. An attacker who can read those debug logs gets the database credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pghoard --version` or check the installed package version; affected if below `2.7.1`
- Check whether `.pgpass` is used for connections in the pghoard config
- Check whether debug logging is enabled and whether those logs are readable by others

## Fix

- Upgrade pghoard to `2.7.1` or later
- Rotate the PostgreSQL password if debug logs with credentials may have been stored or shipped elsewhere

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54711
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-54711

## From the sources

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_