CVE-2026-125328
Received
Received - Intake
Information Disclosure in pgEdge Go LLM Library
Vulnerability report for CVE-2026-125328, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-10
Last updated on: 2026-11-10
Assigner: GitHub, Inc.
Description
Description
pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pgedge | go_llm_library | From 0.1.0 (exc) to 0.2.0 (inc) |
| pgedge | pgedge_go_llm_lib | 0.1.0 |
| pgedge | pgedge_go_llm_lib | 0.1.1 |
| pgedge | pgedge_go_llm_lib | From 0.2.0 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
| CWE-209 | The product generates an error message that includes sensitive information about its environment, users, or associated data. |
