CVE-2026-125327 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
pgEdge RAG Server, a retrieval-augmented generation API over PostgreSQL and pgvector, reads the entire filtered corpus with no LIMIT and rebuilds an in-memory BM25 index on every request. Because the query endpoint is unauthenticated, has no rate limit, and hybrid search is on by default, a remote attacker can exhaust database, CPU and service resources with inexpensive queries.
first public Sep 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running pgEdge RAG Server before 2.0.0 that expose its query endpoint to networks where untrusted callers can reach it. Hybrid search is enabled by default, so default configurations are exposed. Deployments that keep the endpoint on a trusted internal network with access controls in front of it are at lower risk.
Not affected if endpoint-not-reachable-remotely, version-2.0.0-or-later
Who cares pgedge-rag-server, pgvector, postgresql, self-hosted
2.0.0 are affected.HybridEnabled is still at its default in internal/config/loader.go or your configuration.2.0.0 or later.pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
This page as ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.