CVE-2026-54711

LowCVSS 2.4

Published: 23/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

pghoard, a PostgreSQL backup daemon, prior to version 2.7.1 logs database connection information including username and password at debug level when using .pgpass. The issue is patched in version 2.7.1.

Risk Assessment

Database credentials may leak into log files, enabling unauthorized access to the PostgreSQL database for anyone with log visibility.

Recommendation

Upgrade pghoard to version 2.7.1 or later. Review and purge existing debug logs of potentially exposed credentials and consider rotating passwords.

Other vulnerabilities in pghoard

CVE-2026-63120High
An incomplete path traversal fix in pghoard, a PostgreSQL backup daemon, allows an attacker with write access to the backup object storage (S3, GCS, Azure) to write arbitrary files and create directories outside the PostgreSQL data directory. A malicious delta backup manifest with path traversal sequences can write arbitrary payloads to the host during a restore operation. The issue is patched in version 2.7.2.

Original NVD description (English source)

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS