VulnerabilityAnalyzed

CVE-2025-67745

MyHoard is a daemon for creating, managing and restoring MySQL backups.

HIGH 7.5EPSS 0.15%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direct logs into /dev/null.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.15% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-402
Affected: aiven/myhoard
Source: security-advisories@github.com

References

https://github.com/Aiven-Open/myhoard/commit/fac89793bfc8c81ae040aadf5292f5d0100b6640Patch
https://github.com/Aiven-Open/myhoard/security/advisories/GHSA-v42r-6hr9-4hcrVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.