[GHSA-mpx4-jmpr-vm8v] PGHoard: Password written to debug log

[kgnio]

Updates

• Affected products

Comments
The structured affected-version range is incomplete and the first patched release is missing.

The advisory currently lists versions through 2.1.0 as affected, but the vulnerability was fixed by commit 711a447ab552b046a6d356bd6643c0add4620b5f, which suppresses logging of the PostgreSQL credential-containing pgpass line.

This fix was introduced after version 2.7.0 and is included in the 2.7.1 release. The upstream advisory explicitly recommends upgrading to version 2.7.1 or greater, and the 2.7.1 release notes state that the release fixes CVE-2026-54711.

This change therefore updates:

Affected versions:
<= 2.1.0 → < 2.7.1

Patched versions:
None → 2.7.1

No changes are made to the title, Description, CWE, CVSS, severity, references, or source code location.

References:

• Upstream fix commit:
  Aiven-Open/pghoard@711a447

• PGHoard 2.7.1 release:
  https://github.com/Aiven-Open/pghoard/releases/tag/2.7.1

• Upstream security advisory:
  GHSA-mpx4-jmpr-vm8v

[github]

Hi there @falconkirtaran! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory