This vulnerability causes the Llama Stack application, before version 0.4.0rc3, to write the pgvector database password in plaintext into its initialization log file. The leaked credential is a direct violation of confidentiality, allowing anyone who can read the log files to potentially authenticate to the underlying database and access or modify data. The weakness is classified as CWE-532, Sensitive Information Exposure in log data.

The affected product is Llama Stack by llamastack, specifically all releases prior to 0.4.0rc3. Systems running those versions contain unmasked pgvector passwords in their startup logs.

The CVSS score of 3.2 indicates a low severity, and the EPSS score of less than 1% suggests a very low probability of widespread exploitation. The issue is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to have read access to the application’s log files, which may be available locally or remotely if logs are exposed over a network. Consequently, the attack vector is inferred to be local filesystem access or remote log exposure; precise vectors are not detailed in the advisory.