{"id":"CVE-2026-125325","kind":"vulnerability","aliases":["CVE-2026-125325"],"related":[],"title":"pgEdge RAG Server: shared BM25 index leaks documents across tenants","description":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0.","summary":"pgEdge RAG Server is an API server that runs retrieval-augmented generation over PostgreSQL content. Before 2.0.0, concurrent unauthenticated queries share one keyword index, so a request can get documents loaded by another request's filter, including another tenant's or customer's data.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pgEdge RAG Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-tooling","multi-tenant","pgedge-rag-server","pgvector","postgresql"],"not_affected_if":["single-tenant","version-2.0.0-or-later"],"how_to_check":"- Check the installed pgEdge RAG Server version; versions below `2.0.0` are affected.\n- Check whether the query endpoint is reachable without authentication, and whether one pipeline serves several tenants or customers.\n- Server logs cannot show which responses were affected, per the description.","fix":"- Upgrade pgEdge RAG Server to `2.0.0`.","status":"open","published_at":"2026-11-10T18:17:33+00:00","first_seen_at":"2026-11-10T18:22:56+00:00","triaged_at":"2026-11-10T18:24:59+00:00","updated_at":"2026-11-10T18:24:59+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-10T18:24:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pgEdge RAG Server to `2.0.0`.","reach":"internet","title":"pgEdge RAG Server: shared BM25 index leaks documents across tenants","impact":"medium","summary":"pgEdge RAG Server is an API server that runs retrieval-augmented generation over PostgreSQL content. Before 2.0.0, concurrent unauthenticated queries share one keyword index, so a request can get documents loaded by another request's filter, including another tenant's or customer's data.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["pgedge-rag-server","postgresql","pgvector","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Requests read documents belonging to other tenants or customers.","analyst_note":"","how_to_check":"- Check the installed pgEdge RAG Server version; versions below `2.0.0` are affected.\n- Check whether the query endpoint is reachable without authentication, and whether one pipeline serves several tenants or customers.\n- Server logs cannot show which responses were affected, per the description.","plain_action":"","product_name":"pgEdge RAG Server","needs_analyst":false,"not_affected_if":["single-tenant","version-2.0.0-or-later"],"who_is_affected":"Deployments of pgEdge RAG Server before 2.0.0 that expose the unauthenticated query endpoint and serve more than one tenant or customer from the same pipeline. Single-tenant deployments with no untrusted callers are less exposed. The description does not say whether authentication is required in front of the endpoint.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000779,"input_tokens":4688,"output_tokens":620,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125325':13A,16A '-2026':12A,15A '2.0.0':49B,96C,171C 'across':9A 'affect':155C 'ai':21B 'ai-tool':20B 'allow':126C 'anoth':65B,70B,135C 'api':37B,82C 'augment':43B,87C 'belong':144C 'bm25':5A,98C 'cannot':157C 'clear':119C 'concurr':50B,115C 'content':47B,91C 'corpus':132C 'custom':74B,150C 'cve':11A,14A 'data':76B 'differ':147C 'document':8A,62B,143C 'endpoint':113C 'filter':68B,139C 'fix':168C 'generat':44B,88C 'get':61B 'identifi':159C 'includ':69B 'index':6A,56B,100C 'input':153C 'issu':166C 'keyword':55B,99C 'leak':7A 'load':63B 'lock':117C 'log':164C 'malform':152C 'multi':24B 'multi-ten':23B 'object':107C 'one':54B,127C 'oper':123C 'per':105C 'per-pipelin':104C 'pgedg':1A,27B,32B,77C 'pgedge':17A 'pgedge-rag-serv':26B 'pgvector':30B,93C 'pipelin':106C 'popul':133C 'postgresql':31B,46B,90C 'prior':94C 'queri':52B,112C 'rag':2A,18A,28B,33B,78C 'refil':120C 'request':59B,66B,116C,128C,136C 'respons':156C 'retriev':42B,86C 'retrieval-aug':41B,85C 'retrospect':160C 'return':142C 'run':40B 'search':122C,130C,138C 'separ':124C 'server':3A,19A,29B,34B,38B,79C,83C,163C 'share':4A,53B,108C 'singl':103C 'tenant':10A,25B,71B,148C 'tool':22B 'unauthent':51B,111C 'use':92C 'version':170C 'without':151C","nicknames":[],"mitigations":[],"who_affected":"Deployments of pgEdge RAG Server before 2.0.0 that expose the unauthenticated query endpoint and serve more than one tenant or customer from the same pipeline. Single-tenant deployments with no untrusted callers are less exposed. The description does not say whether authentication is required in front of the endpoint.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["pgedgeragserver","ragserver"],"ptokens":["pgedge","rag","server"],"labels":["aitooling","medium","multitenant","pgedgeragserver","pgvector","postgresql","vendor"],"campaign_type":null,"search_a":"'-125325':13A,16A '-2026':12A,15A 'across':9A 'bm25':5A 'cve':11A,14A 'document':8A 'index':6A 'leak':7A 'pgedg':1A 'pgedge':17A 'rag':2A,18A 'server':3A,19A 'share':4A 'tenant':10A","search_b":"'2.0.0':49B 'ai':21B 'ai-tool':20B 'anoth':65B,70B 'api':37B 'augment':43B 'concurr':50B 'content':47B 'custom':74B 'data':76B 'document':62B 'filter':68B 'generat':44B 'get':61B 'includ':69B 'index':56B 'keyword':55B 'load':63B 'multi':24B 'multi-ten':23B 'one':54B 'pgedg':27B,32B 'pgedge-rag-serv':26B 'pgvector':30B 'postgresql':31B,46B 'queri':52B 'rag':28B,33B 'request':59B,66B 'retriev':42B 'retrieval-aug':41B 'run':40B 'server':29B,34B,38B 'share':53B 'tenant':25B,71B 'tool':22B 'unauthent':51B","search_c":"'2.0.0':96C,171C 'affect':155C 'allow':126C 'anoth':135C 'api':82C 'augment':87C 'belong':144C 'bm25':98C 'cannot':157C 'clear':119C 'concurr':115C 'content':91C 'corpus':132C 'custom':150C 'differ':147C 'document':143C 'endpoint':113C 'filter':139C 'fix':168C 'generat':88C 'identifi':159C 'index':100C 'input':153C 'issu':166C 'keyword':99C 'lock':117C 'log':164C 'malform':152C 'object':107C 'one':127C 'oper':123C 'per':105C 'per-pipelin':104C 'pgedg':77C 'pgvector':93C 'pipelin':106C 'popul':133C 'postgresql':90C 'prior':94C 'queri':112C 'rag':78C 'refil':120C 'request':116C,128C,136C 'respons':156C 'retriev':86C 'retrieval-aug':85C 'retrospect':160C 'return':142C 'search':122C,130C,138C 'separ':124C 'server':79C,83C,163C 'share':108C 'singl':103C 'tenant':148C 'unauthent':111C 'use':92C 'version':170C 'without':151C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-03T12:43:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125325","severity":null,"published_at":"2026-11-10T18:17:33+00:00","modified_at":"2026-11-10T18:17:33+00:00","first_seen_at":"2026-11-10T18:22:56+00:00","fetched_at":"2026-11-10T18:22:56+00:00","note":null}],"documents":[{"id":116908,"url":"https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116909,"url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116910,"url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-w437-9mwm-j6vq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T12:43:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}