Database Connection Information Exposure in pghoard by Aiven
CVE-2026-54711

2.4LOW

Key Information:

Vendor

Aiven-open

Status
Pghoard
Vendor
CVE Published:
23 October 2026

What is CVE-2026-54711?

pghoard, a PostgreSQL backup daemon developed by Aiven, contains a vulnerability prior to version 2.7.1 that logs critical database connection credentials, including usernames and passwords, at the debug level when using .pgpass. This can lead to unauthorized access if log files are improperly secured. The issue has been resolved in version 2.7.1, making it essential for users to update to this version to safeguard their sensitive data.

Affected Version(s)

pghoard < 2.7.1

References

https://github.com/Aiven-Open/pghoard/security/advisories...
x_refsource_CONFIRM
https://github.com/Aiven-Open/pghoard/releases/tag/2.7.1
x_refsource_MISC

CVSS V4

Score:
2.4
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.