When maintain-dbusers and its service running on the NFS server write a replica.my.cnf file, the full content of the file is passed as a parameter to write_replica_cnf.sh. On Unix systems the full command line is not at all secure: the password is logged into sudo logs, exposed via ps (see e.g. T396232), etc.

This is not particularly exploitable as the NFS servers are restricted to Toolforge admins only, but should be fixed regardless. (I think the easiest way would be to pass the file contents as standard input to the helper script.)