PGEDGE RAG SERVER · CVE-2026-125325 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
pgEdge RAG Server is an API server that runs retrieval-augmented generation over PostgreSQL content. Before 2.0.0, concurrent unauthenticated queries share one keyword index, so a request can get documents loaded by another request's filter, including another tenant's or customer's data.
first public Sep 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments of pgEdge RAG Server before 2.0.0 that expose the unauthenticated query endpoint and serve more than one tenant or customer from the same pipeline. Single-tenant deployments with no untrusted callers are less exposed. The description does not say whether authentication is required in front of the endpoint.
Not affected if single-tenant, version-2.0.0-or-later
Who cares multi-tenant, pgedge-rag-server, pgvector, postgresql
2.0.0 are affected.2.0.0.pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0.
This page as ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.