Aiven-Open CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW Aiven-Open CVE published 2026-10-23

CVE-2026-54711

Aiven-Open's pghoard, a PostgreSQL backup daemon and restore tooling, logs database connection information, including usernames and passwords, at the debug level when using .pgpass. This issue was patched in version 2.7.1. Defenders responsible for PostgreSQL deployments using pghoard, especially those with .pgpass configured, should assess exposure and prioritize upgrading to version 2.7.1 or later. The [truncated]

HIGH Aiven-Open CVE published 2026-10-23

CVE-2026-63120

CVE-2026-63120 is a high-severity vulnerability in pghoard, a PostgreSQL backup daemon and restore tool. An incomplete path traversal fix allows an attacker with write access to backup object storage to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory. This issue has been patched in version 2.7.2.