{"id":"CVE-2026-125326","kind":"vulnerability","aliases":["CVE-2026-125326"],"related":[],"title":"pgEdge RAG Server: error responses can leak part of a provider API key","description":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.","summary":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL. Before 2.0.0, its unauthenticated query API returns raw error text from failed LLM provider calls, which can quote a partially masked operator API key to any remote caller.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pgEdge RAG Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-tooling","llm-providers","pgedge-rag-server","pgvector","postgresql"],"not_affected_if":["auth-required","internal-only"],"how_to_check":"- Check the installed pgEdge RAG Server version; versions before `2.0.0` are affected.\n- Look for an unauthenticated query endpoint exposed to the network in the RAG server handlers in `internal/server/handlers.go`.","fix":"- pgEdge RAG Server: upgrade to `2.0.0`.","status":"open","published_at":"2026-11-10T18:17:34+00:00","first_seen_at":"2026-11-10T18:22:56+00:00","triaged_at":"2026-11-10T18:25:05+00:00","updated_at":"2026-11-10T18:25:05+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-10T18:25:05Z","model":"claude-haiku-5-5","output":{"fix":"- pgEdge RAG Server: upgrade to `2.0.0`.","reach":"internet","title":"pgEdge RAG Server: error responses can leak part of a provider API key","impact":"medium","summary":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL. Before 2.0.0, its unauthenticated query API returns raw error text from failed LLM provider calls, which can quote a partially masked operator API key to any remote caller.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["pgedge-rag-server","pgvector","postgresql","llm-providers"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"remote caller reads part of the operator's provider API key","analyst_note":"","how_to_check":"- Check the installed pgEdge RAG Server version; versions before `2.0.0` are affected.\n- Look for an unauthenticated query endpoint exposed to the network in the RAG server handlers in `internal/server/handlers.go`.","plain_action":"","product_name":"pgEdge RAG Server","needs_analyst":false,"not_affected_if":["auth-required","internal-only"],"who_is_affected":"Teams running pgEdge RAG Server before 2.0.0 with the query API reachable by remote callers. The leak happens when an LLM provider call fails, so the exposed key is the operator's third-party provider credential. Deployments where the query API is behind authentication or not reachable from outside are less exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4669,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125326':16A,19A '-2026':15A,18A '2.0.0':50B,96C,160C 'account':147C 'ai':24B 'ai-tool':23B 'api':12A,40B,54B,71B,82C,100C,123C,151C 'augment':45B,87C 'authent':131C 'call':63B,109C 'caller':76B,127C 'caus':129C 'content':91C 'control':113C 'credenti':140C 'cve':14A,17A 'err.error':104C 'error':4A,57B,114C,152C 'fail':60B,106C 'failur':132C 'fix':157C 'generat':46B,88C 'internal/server/handlers.go':102C 'issu':155C 'key':13A,72B,124C 'leak':7A 'llm':27B,61B,107C 'llm-provid':26B 'mask':69B,121C 'obtain':134C 'oper':70B,138C 'part':8A,135C 'parti':145C 'partial':68B,120C 'pgedg':1A,30B,35B,77C 'pgedge':20A 'pgedge-rag-serv':29B 'pgvector':33B,93C 'postgresql':34B,48B,90C 'preserv':110C 'prior':94C 'provid':11A,28B,62B,108C,112C,146C 'provider-control':111C 'queri':53B,99C,150C 'quot':66B,118C 'rag':2A,21A,31B,36B,78C 'raw':56B 'remot':75B,126C 'respons':5A,153C 'retriev':44B,86C 'retrieval-aug':43B,85C 'return':55B,103C 'server':3A,22A,32B,37B,41B,79C,83C 'submit':122C 'text':58B,115C 'third':144C 'third-parti':143C 'tool':25B 'unauthent':52B,98C 'use':92C 'version':159C","nicknames":[],"mitigations":[],"who_affected":"Teams running pgEdge RAG Server before 2.0.0 with the query API reachable by remote callers. The leak happens when an LLM provider call fails, so the exposed key is the operator's third-party provider credential. Deployments where the query API is behind authentication or not reachable from outside are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["pgedgeragserver","ragserver"],"ptokens":["pgedge","rag","server"],"labels":["aitooling","llmproviders","medium","pgedgeragserver","pgvector","postgresql","vendor"],"campaign_type":null,"search_a":"'-125326':16A,19A '-2026':15A,18A 'api':12A 'cve':14A,17A 'error':4A 'key':13A 'leak':7A 'part':8A 'pgedg':1A 'pgedge':20A 'provid':11A 'rag':2A,21A 'respons':5A 'server':3A,22A","search_b":"'2.0.0':50B 'ai':24B 'ai-tool':23B 'api':40B,54B,71B 'augment':45B 'call':63B 'caller':76B 'error':57B 'fail':60B 'generat':46B 'key':72B 'llm':27B,61B 'llm-provid':26B 'mask':69B 'oper':70B 'partial':68B 'pgedg':30B,35B 'pgedge-rag-serv':29B 'pgvector':33B 'postgresql':34B,48B 'provid':28B,62B 'queri':53B 'quot':66B 'rag':31B,36B 'raw':56B 'remot':75B 'retriev':44B 'retrieval-aug':43B 'return':55B 'server':32B,37B,41B 'text':58B 'tool':25B 'unauthent':52B","search_c":"'2.0.0':96C,160C 'account':147C 'api':82C,100C,123C,151C 'augment':87C 'authent':131C 'call':109C 'caller':127C 'caus':129C 'content':91C 'control':113C 'credenti':140C 'err.error':104C 'error':114C,152C 'fail':106C 'failur':132C 'fix':157C 'generat':88C 'internal/server/handlers.go':102C 'issu':155C 'key':124C 'llm':107C 'mask':121C 'obtain':134C 'oper':138C 'part':135C 'parti':145C 'partial':120C 'pgedg':77C 'pgvector':93C 'postgresql':90C 'preserv':110C 'prior':94C 'provid':108C,112C,146C 'provider-control':111C 'queri':99C,150C 'quot':118C 'rag':78C 'remot':126C 'respons':153C 'retriev':86C 'retrieval-aug':85C 'return':103C 'server':79C,83C 'submit':122C 'text':115C 'third':144C 'third-parti':143C 'unauthent':98C 'use':92C 'version':159C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-03T12:43:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125326","severity":null,"published_at":"2026-11-10T18:17:34+00:00","modified_at":"2026-11-10T18:17:34+00:00","first_seen_at":"2026-11-10T18:22:56+00:00","fetched_at":"2026-11-10T18:22:56+00:00","note":null}],"documents":[{"id":116911,"url":"https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116909,"url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116913,"url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T12:43:22+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}