PT-2026-5384 · Pgvector+1 · Pgvector+1

Published 2026-01-30 · Updated 2026-01-30 · CVE-2026-25211

Positive Technologies (AI Summary)

CVSS v3.1

3.2

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Llama Stack versions prior to 0.4.0rc3

Description The software does not properly conceal the pgvector password within the initialization logs, potentially exposing sensitive credentials.

Recommendations Update to version 0.4.0rc3 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-25211

GHSA-XMFJ-7PP5-FXR6

Affected Products

Llama Stack

Pgvector

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-25211 · Security Note
• https://osv.dev/vulnerability/GHSA-xmfj-7pp5-fxr6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25211 · Vendor Advisory
• https://github.com/llamastack/llama-stack · Note
• https://github.com/llamastack/llama-stack/commit/b709bd77b6c1fad68a30a4888baa6f2337eaef6f · Note
• https://github.com/llamastack/llama-stack/pull/4439 · Note
• https://github.com/llamastack/llama-stack/compare/v0.4.0rc2...v0.4.0rc3 · Note
• https://twitter.com/CVEnew/status/2017144500414796240 · Twitter Post
• https://t.me/cveNotify/150373 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2017157543211028688 · Twitter Post