~ / search / GHSA-mpx4-jmpr-vm8v

GHSA-mpx4-jmpr-vm8v

PGHoard: Password written to debug log

Source: GitHub Advisory Database (reviewed) Low CVE-2026-54711

Packages

EcosystemPackageAffectedFixed in
PyPI pghoard <= 2.1.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When using .pgpass, database connection information including the username and password will be logged at the debug level. ### Patches Upgrade to version 2.7.1 or greater. ### Workarounds Filter out debug-level logs. ### References This issue was discovered by BugCrowd user DRAKOKORIAN.

References

External links from the advisory. They lead to third-party sites.