pghoard logs PostgreSQL connection details, including usernames and passwords, at the debug level when a .pgpass file is used. This flaw, catalogued as CWE-532, can reveal sensitive credentials to anyone able to read the debug log output, enabling credential theft or account takeover if the logs are accessible to attackers or compromised staff. The CVSS score of 2.4 reflects the limited impact scope, as the vulnerability requires the debug mode to be enabled and does not allow arbitrary code execution or system compromise.

The Aiven-Open pghoard backup daemon is affected. All versions prior to 2.7.1 expose the .pgpass contents in debug logs. Upgrading to 2.7.1 or later removes the insecure logging functionality.

Risk assessment indicates low severity with a CVSS of 2.4 and no presence in the CISA KEV catalog. Exploitability is contingent on an attacker having access to the debug log files or the ability to enable debugging. If debug logging is disabled or log access is properly restricted, the risk is largely mitigated.