PGHoard: Password written to debug log
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.7.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
PGHoard, a PostgreSQL backup and restore tool that stores backups in cloud object storage, is affected. When it used a .pgpass file for database connections, it could write the database username and password into debug logs, which could expose those credentials to anyone who can read the logs.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Aiven-Open pghoard
fixed in 2.7.1
- pghoardPyPI
through 2.1.0