---
id: CVE-2026-54711
title: 'PGHoard: Password written to debug log'
summary: >-
  pghoard is a PostgreSQL backup daemon and restore tooling that stores backup
  data in cloud object stores. Prior to version 2.7.1, when using .pgpass,
  database connection information including the username and password will be
  logged at t…
severity: low
cvss: 2.4
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-532
vendor: Aiven-Open
product: pghoard
affected:
  - pghoard < 2.7.1
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:16:38.258Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54711'
references:
  - url: >-
      https://github.com/Aiven-Open/pghoard/security/advisories/GHSA-mpx4-jmpr-vm8v
    label: >-
      https://github.com/Aiven-Open/pghoard/security/advisories/GHSA-mpx4-jmpr-vm8v
  - url: 'https://github.com/Aiven-Open/pghoard/releases/tag/2.7.1'
    label: 'https://github.com/Aiven-Open/pghoard/releases/tag/2.7.1'
  - url: 'https://github.com/advisories/GHSA-mpx4-jmpr-vm8v'
tags:
  - cve.org
  - ghsa
  - pip
ecosystem: pip
ingestedAt: '2026-06-19T03:39:00.799Z'
epss: 0.00156
epssPercentile: 0.04745
---

## Overview

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.

## Affected

- `pghoard < 2.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54711)

Affected packages:

- `pghoard <= 2.1.0`

Source: https://github.com/advisories/GHSA-mpx4-jmpr-vm8v