GHSA-XMFJ-7PP5-FXR6 Llama Stack exposes secret in initialization log

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

CVE-2026-25211

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

CVE-2026-25211

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

CVE-2026-25211

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

CVE-2026-25211

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

CVE-2026-25211

Llama Stack (llama-stack)

CVE-2026-25211

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

EUVD-2026-5041

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

PT-2026-5384

Name of the Vulnerable Software and Affected Versions Llama Stack versions prior to 0.4.0rc3 Description The software does not properly conceal the pgvector password within the initialization logs, potentially exposing sensitive credentials. Recommendations Update to version 0.4.0rc3 or later...

CVE-2026-25211: Insertion of Sensitive Information into Log File

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

Llama Stack log information leakage vulnerability

Llama Stack is a core building block for simplified artificial intelligence application development, open-sourced by Meta Llama. Versions of Llama Stack prior to 0.4.0rc3 contained a vulnerability related to log information leakage. This vulnerability stemmed from the fact that the log...

Exploit for CVE-2024-50050

--- 💀 LlamaStack-RCE: CVE-2024-50050 Supply Chain Exploitatio...

CVE-2026-1234

A security issue was identified in the Llama Stack server when PGVector is used as a vector store provider. During initialization, the server logs print the PGVector database password in clear text. This occurs due to insufficient redaction of sensitive configuration fields. As a result, anyone...

Remote Code Execution (RCE)

Llama Stack is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper validation of parameters in the resolveastbytype function, which allows an attacker to supply malicious input leading to arbitrary code execution...

EUVD-2025-31066

Malicious code in bioql PyPI...

Cross-site Scripting (XSS)

Overview llama-stack is a Llama Stack Affected versions of this package are vulnerable to Cross-site Scripting XSS via the resolveastbytype function. An attacker can modify application behavior or execute unauthorized actions by supplying unverified parameters. Details Cross-site scripting or XSS...

GHSA-X75H-M6JJ-6CJ2 Llama Stack could potentially allow for remote code execution

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

Llama Stack could potentially allow for remote code execution

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

CVE-2025-55178

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

CVE-2025-55178

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...