CVE-2026-125325
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
62/100
Published: 2026-11-10
Modified: 2026-11-13
First seen: 2026-11-10
Status: active
Attack Surface
Network
No Auth
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
None
A:
None
Description
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0.
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| pgEdge | pgedge-rag-server | < 2.0.0 |
| pgEdge | pgedge-rag-server | < 2.0.0 |