What’s Vulnerable › Vulnerabilities

CVE-2026-25211

• Severity: low (CVSS 3.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-30 · updated 2026-06-17
• Weakness: CWE-532

Description

Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.

Affected products

• llamastack Llama Stack: before 0.4.0rc3 — fixed in 0.4.0rc3

How to fix

Upgrade to a fixed version: llamastack Llama Stack 0.4.0rc3. Check the vendor advisory for mitigations.

References

• https://github.com/llamastack/llama-stack/compare/v0.4.0rc2...v0.4.0rc3
• https://github.com/llamastack/llama-stack/pull/4439

Get alerted when CVE-2026-25211 or the next vulnerability affects your stack