CVE-2026-54711— PGHoard: Password written to debug log
Quick assessment
Affected
Aiven-Open pghoard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
pghoard 是一个用于 PostgreSQL 的备份守护进程及恢复工具，它将备份数据存储于云对象存储中。在 2.7.1 版本之前，若使用 .pgpass 文件，数据库连接信息（包括用户名和密码）会在调试级别被记录到日志中。该问题已在 2.7.1 版本中修复。
Possible ATT&CK Techniques 3 AI
T1003 · OS Credential Dumping T1078 · Valid Accounts T1113 · Screen CaptureAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Aiven-Open | pghoard | < 2.7.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54711
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PGHoard: Password written to debug log
Source: CVE Program / CVE List V5
Vulnerability Description
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Aiven-Open | pghoard | < 2.7.1 | - |
|
II. Public POCs for CVE-2026-54711
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54711
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54711 (1)
-
🔗 Password written to debug log · Advisory · Aiven-Open/pghoard · GitHub x_refsource_CONFIRM
Vendor Pages for CVE-2026-54711 (1)
-
🔗 Release 2.7.1 · Aiven-Open/pghoard · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: Aiven-Open
-
CVE-2026-63120
PGHoard: Incomplete Path Traversal fix in restore.py allows -
CVE-2026-45080
Klaw: Improper Access Control Allows Disclosure of Password -
CVE-2026-44367
Klaw: user lockout due to case sensitivity inconsistency -
CVE-2026-29190
Karapace: Path Traversal in Backup Reader -
CVE-2026-25999
Klaw has an improper authorisation check on /resetMemoryCach
Same weakness: CWE-532
-
CVE-2026-115885
LangGraph CLI prints the registry push token in `langgraph d -
CVE-2026-105963
Secret key base exposed in stack trace arguments on wrong-ty -
CVE-2026-115657
KNIME Analytics Platform logs credentials of configured prox -
CVE-2026-115358
OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Ma -
CVE-2026-16648
Mailer Plus Log - Moderately critical - Access bypass - SA-C
V. Comments for CVE-2026-54711
No comments yet