Unauthenticated API Query Exposure in pgEdge RAG Server
CVE-2026-125326

5.8MEDIUM

Key Information:

Vendor

Pgedge

Status
Pgedge-rag-server
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125326?

The pgEdge RAG Server, an API service designed for retrieval-augmented generation over PostgreSQL content, possesses a vulnerability in its unauthenticated query API. This issue allows an attacker to trigger authentication failures that can expose part of the operator's credentials for third-party provider accounts. Specifically, it occurs due to error messages returned by the API, which may contain masked API keys controlled by the LLM provider. This flaw is addressed in version 2.0.0 of the software, emphasizing the importance of upgrading to ensure protection against potential exploitation.

Affected Version(s)

pgedge-rag-server < 2.0.0

References

https://github.com/pgEdge/pgedge-rag-server/security/advi...
x_refsource_CONFIRM
https://github.com/pgEdge/pgedge-rag-server/pull/45
x_refsource_MISC
https://github.com/pgEdge/pgedge-rag-server/commit/72e078...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.