CVE-2026-125326
Received Received - Intake

Information Disclosure in pgEdge RAG Server

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: GitHub, Inc.

Description
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125326
EUVD
EUVD-2026-121708

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pgedge rag_server 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in pgEdge RAG Server (versions before 2.0.0) involves unauthenticated API endpoints returning raw error messages from LLM providers. These errors may include fragments of the server's API key, even if partially masked, allowing remote attackers to extract credential information without authentication.

Detection Guidance

To detect this vulnerability, check if your pgEdge RAG Server is running a version prior to 2.0.0. Use commands like 'curl -X GET http://<server-address>/v1/health' or 'curl -X POST http://<server-address>/v1/query -H "Content-Type: application/json" -d '{"query":"test"}' to test endpoints for exposed error messages containing API key fragments. Monitor server logs for raw provider error messages in responses.

Impact Analysis

An attacker could trigger authentication failures in the LLM provider and read exposed credential fragments in error responses. This may lead to unauthorized access to the provider account, potential data breaches, or misuse of the API service if credentials are compromised.

Mitigation Strategies

Upgrade pgEdge RAG Server to version 2.0.0 or later to prevent provider error messages from reaching clients. Rotate any LLM provider API keys that may have been exposed. If immediate upgrade is not possible, place the server behind a proxy to filter error responses or ensure provider credentials remain valid to avoid authentication failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125326. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...