What is GHSA-xmfj-7pp5-fxr6?

GHSA-xmfj-7pp5-fxr6 is a security advisory published by GitHub Security Advisories with Low severity. Llama Stack exposes secret in initialization log

Which CVE IDs does GHSA-xmfj-7pp5-fxr6 cover?

GHSA-xmfj-7pp5-fxr6 covers the following CVE IDs: CVE-2026-25211. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xmfj-7pp5-fxr6?

GHSA-xmfj-7pp5-fxr6 has a CVSS v3 base score of 3.2, published by GitHub Security Advisories.

Which products are affected by GHSA-xmfj-7pp5-fxr6?

GHSA-xmfj-7pp5-fxr6 affects 1 product, including: pip/llama-stack:\u003c 0.4.4.

GHSA-xmfj-7pp5-fxr6LowCVSS 3.2

Llama Stack exposes secret in initialization log

Vendor

GitHub Security Advisories

Published

January 30, 2026

Last Modified

January 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-25211 →

📋 Description

Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.

🎯 Affected products1

pip/llama-stack:< 0.4.4

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-25211
https://github.com/llamastack/llama-stack/compare/v0.4.0rc2...v0.4.0rc3
https://github.com/llamastack/llama-stack/commit/b709bd77b6c1fad68a30a4888baa6f2337eaef6f
https://github.com/advisories/GHSA-xmfj-7pp5-fxr6