SZB-fa02ddae73
pghoard versions before 2.7.1 may log database credentials when using .pgpass
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Aiven-Open
- Product
- pghoard
- First seen
Summary
The EUVD database entry, published 2026-10-23, says pghoard logs database connection information, including usernames and passwords, when .pgpass is used before version 2.7.1. The entry gives a CVSS v3.1 score of 2.4/10.
If you use Aiven-Open
Upgrade pghoard to version 2.7.1 or later
Search existing pghoard logs for exposed database credentials
Rotate any database passwords found in logs
What the sources say 1
· Mastodon: “Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be log...” Source