{"id":"CVE-2026-25211","aliases":["GHSA-xmfj-7pp5-fxr6","PYSEC-2026-1572"],"title":"Llama Stack exposes secret in initialization log","summary":"Llama Stack exposes secret in initialization log","severity":"low","cvss":3.2,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","vendor":"llama-stack","product":"llama-stack","ecosystem":"pip","affected":["llama-stack < 0.4.4"],"patched":["llama-stack 0.4.4"],"published":"2026-01-30","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-xmfj-7pp5-fxr6","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25211"},{"url":"https://github.com/llamastack/llama-stack/commit/b709bd77b6c1fad68a30a4888baa6f2337eaef6f"},{"url":"https://github.com/llamastack/llama-stack"},{"url":"https://github.com/llamastack/llama-stack/compare/v0.4.0rc2...v0.4.0rc3"}],"tags":["osv","pip","exploit-available"],"epss":0.00228,"epssPercentile":0.13814,"ingestedAt":"2026-07-08T18:25:54.205Z","exploits":{"github":1,"githubRepos":["https://github.com/mbanyamer/Llama-Stack-0.4.0rc3-local-CVE-2026-25211"],"checkedAt":"2026-09-21T15:28:32.926Z"},"exploitAvailable":true,"slug":"CVE-2026-25211","body":"## Overview\n\nLlama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.\n\n## Affected packages\n\n- `llama-stack < 0.4.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `llama-stack 0.4.4`","depth":"twilight","depthScore":30,"depthScoreParts":{"impact":17.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":5035,"id":"CVE-2026-25211","ts":1788887229978,"field":"exploit_available","old":"false","new":"true"},{"seq":3918,"id":"CVE-2026-25211","ts":1788886360667,"field":"exploit_available","old":"true","new":"false"},{"seq":2740,"id":"CVE-2026-25211","ts":1788883027426,"field":"exploit_available","old":"false","new":"true"},{"seq":1769,"id":"CVE-2026-25211","ts":1788882430459,"field":"exploit_available","old":"true","new":"false"},{"seq":875,"id":"CVE-2026-25211","ts":1788881863714,"field":"exploit_available","old":"false","new":"true"}]}