VYPR
Low severity3.2OSV Advisory· Published Jan 30, 2026· Updated Apr 15, 2026

CVE-2026-25211

CVE-2026-25211

Description

Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
llama-stackPyPI
< 0.4.40.4.4

Affected products

1

Patches

1
b709bd77b6c1

chore: censor pgvector password in initialization log (#4439)

https://github.com/llamastack/llama-stackMark CampbellJan 5, 2026via ghsa
1 file changed · +3 1
  • src/llama_stack/providers/remote/vector_io/pgvector/pgvector.py+3 1 modified
    @@ -341,7 +341,9 @@ def __init__(
             self.metadata_collection_name = "openai_vector_stores_metadata"
     
         async def initialize(self) -> None:
    -        log.info(f"Initializing PGVector memory adapter with config: {self.config}")
    +        # Create a safe config representation with masked password for logging
    +        safe_config = {**self.config.model_dump(exclude={"password"}), "password": "******"}
    +        log.info(f"Initializing PGVector memory adapter with config: {safe_config}")
             self.kvstore = await kvstore_impl(self.config.persistence)
             await self.initialize_openai_vector_stores()
     
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.