CVE-2026-125326
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
72/100
Published: 2026-11-10
Modified: 2026-11-12
First seen: 2026-11-10
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Changed
C:
Low
I:
None
A:
None
Description
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| pgEdge | pgedge-rag-server | < 2.0.0 |
| pgEdge | pgedge-rag-server | < 2.0.0 |