CVE-2026-125326

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.

• https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61
• https://github.com/pgEdge/pgedge-rag-server/pull/45
• https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0
• https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg

• https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61
• https://github.com/pgEdge/pgedge-rag-server/pull/45
• https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0
• https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg

• MEDIUMCVE-2026-125328PoC
• MEDIUMCVE-2025-1350
• LOWCVE-2026-100264
• HIGHCVE-2026-100298
• MEDIUMCVE-2026-100569PoC
• MEDIUMCVE-2026-100677PoC
• MEDIUMCVE-2026-101029PoC
• UNSCOREDCVE-2026-101034

Related by shared AI tags and CWE weakness class. Browse the full archive.