What is GHSA-mpx4-jmpr-vm8v?

GHSA-mpx4-jmpr-vm8v is a security advisory published by GitHub Security Advisories with Low severity. PGHoard: Password written to debug log

Which CVE IDs does GHSA-mpx4-jmpr-vm8v cover?

GHSA-mpx4-jmpr-vm8v covers the following CVE IDs: CVE-2026-54711. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-mpx4-jmpr-vm8v?

GHSA-mpx4-jmpr-vm8v affects 1 product, including: pip/pghoard:\u003c= 2.1.0.

GHSA-mpx4-jmpr-vm8vLow

PGHoard: Password written to debug log

Vendor

GitHub Security Advisories

Published

June 18, 2026

Last Modified

June 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-54711 →

📋 Description

Impact

When using .pgpass, database connection information including the username and password will be logged at the debug level.

Patches

Upgrade to version 2.7.1 or greater.

Workarounds

Filter out debug-level logs.

References

This issue was discovered by BugCrowd user DRAKOKORIAN.

🎯 Affected products1

pip/pghoard:<= 2.1.0

🔗 References (2)

https://github.com/Aiven-Open/pghoard/security/advisories/GHSA-mpx4-jmpr-vm8v
https://github.com/advisories/GHSA-mpx4-jmpr-vm8v