API Server Vulnerability in pgEdge RAG Server by pgEdge
CVE-2026-125325

5.9MEDIUM

Key Information:

Vendor

Pgedge

Status
Pgedge-rag-server
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125325?

The pgEdge RAG Server, an API server designed for retrieval-augmented generation over PostgreSQL content, exhibits an improper access control issue prior to version 2.0.0. Specifically, the BM25 keyword index is configured as a single shared object for each pipeline, which is accessible through an unauthenticated query endpoint. This flawed configuration permits concurrent requests to unintentionally influence each other, potentially allowing unauthorized access to documents from different tenants or customers. Importantly, this vulnerability cannot be retrospectively detected via server logs. Users are strongly encouraged to upgrade to version 2.0.0 or later to mitigate this serious issue.

Affected Version(s)

pgedge-rag-server < 2.0.0

References

https://github.com/pgEdge/pgedge-rag-server/security/advi...
x_refsource_CONFIRM
https://github.com/pgEdge/pgedge-rag-server/pull/44
x_refsource_MISC
https://github.com/pgEdge/pgedge-rag-server/commit/a09d48...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.