{"id":"CVE-2026-125327","kind":"vulnerability","aliases":["CVE-2026-125327"],"related":[],"title":"pgEdge RAG Server: unauthenticated query endpoint lets remote users exhaust resources","description":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.","summary":"pgEdge RAG Server, a retrieval-augmented generation API over PostgreSQL and pgvector, reads the entire filtered corpus with no LIMIT and rebuilds an in-memory BM25 index on every request. Because the query endpoint is unauthenticated, has no rate limit, and hybrid search is on by default, a remote attacker can exhaust database, CPU and service resources with inexpensive queries.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","pgedge-rag-server","pgvector","postgresql","self-hosted"],"not_affected_if":["endpoint-not-reachable-remotely","version-2.0.0-or-later"],"how_to_check":"- Check the deployed pgEdge RAG Server version; versions below `2.0.0` are affected.\n- Check whether the query endpoint is reachable from outside your network without credentials.\n- Check whether `HybridEnabled` is still at its default in `internal/config/loader.go` or your configuration.","fix":"- pgEdge RAG Server: upgrade to `2.0.0` or later.","status":"open","published_at":"2026-11-10T19:21:09+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","triaged_at":"2026-11-10T19:43:15+00:00","updated_at":"2026-11-10T19:43:15+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-10T19:43:15Z","model":"claude-haiku-5-5","output":{"fix":"- pgEdge RAG Server: upgrade to `2.0.0` or later.","reach":"network","title":"pgEdge RAG Server: unauthenticated query endpoint lets remote users exhaust resources","impact":"medium","summary":"pgEdge RAG Server, a retrieval-augmented generation API over PostgreSQL and pgvector, reads the entire filtered corpus with no LIMIT and rebuilds an in-memory BM25 index on every request. Because the query endpoint is unauthenticated, has no rate limit, and hybrid search is on by default, a remote attacker can exhaust database, CPU and service resources with inexpensive queries.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["pgedge-rag-server","pgvector","postgresql","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"remote callers exhaust database and CPU, taking the service down","analyst_note":"','product_name':'pgEdge RAG Server','product_ecosystem':'vendor'","how_to_check":"- Check the deployed pgEdge RAG Server version; versions below `2.0.0` are affected.\n- Check whether the query endpoint is reachable from outside your network without credentials.\n- Check whether `HybridEnabled` is still at its default in `internal/config/loader.go` or your configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2.0.0-or-later","endpoint-not-reachable-remotely"],"who_is_affected":"Teams running pgEdge RAG Server before 2.0.0 that expose its query endpoint to networks where untrusted callers can reach it. Hybrid search is enabled by default, so default configurations are exposed. Deployments that keep the endpoint on a trusted internal network with access controls in front of it are at lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001365,"input_tokens":4701,"output_tokens":1789,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125327':14A,17A '-2026':13A,16A '2.0.0':111C,178C 'ai':19B 'ai-tool':18B 'api':38B,97C 'attack':81B 'augment':36B,102C 'bm25':57B,135C 'content':106C 'corpus':47B,125C,166C 'cpu':85B,162C 'cve':12A,15A 'databas':84B,160C 'default':78B,145C 'endpoint':6A,65B,115C,150C 'entir':45B,123C 'everi':60B,138C 'exhaust':10A,83B,169C 'fetchdocu':117C 'filter':46B,124C 'fix':175C 'generat':37B,103C 'host':29B 'hybrid':73B 'hybriden':141C 'impos':159C 'in-memori':54B,132C 'index':58B,136C 'inexpens':90B,155C 'internal/config/loader.go':147C 'internal/database/search.go':119C 'issu':173C 'let':7A 'limit':50B,71B,128C,154C 'memori':56B,134C 'pgedg':1A,22B,30B,92C 'pgedge-rag-serv':21B 'pgvector':25B,42B,108C 'postgresql':26B,40B,105C 'prior':109C 'proport':164C 'queri':5A,64B,91B,114C,157C 'rag':2A,23B,31B,93C 'rate':70B,153C 'read':43B,121C 'rebuild':52B,130C 'remot':8A,80B,156C 'request':61B,139C 'resourc':11A,88B,171C 'retriev':35B,101C 'retrieval-aug':34B,100C 'search':74B 'self':28B 'self-host':27B 'server':3A,24B,32B,94C,98C 'servic':87B,170C 'set':143C 'size':167C 'tool':20B 'unauthent':4A,67B,113C 'use':107C,116C 'user':9A 'version':177C 'without':126C 'work':163C","nicknames":[],"mitigations":[],"who_affected":"Teams running pgEdge RAG Server before 2.0.0 that expose its query endpoint to networks where untrusted callers can reach it. Hybrid search is enabled by default, so default configurations are exposed. Deployments that keep the endpoint on a trusted internal network with access controls in front of it are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","pgedgeragserver","pgvector","postgresql","selfhosted"],"campaign_type":null,"search_a":"'-125327':14A,17A '-2026':13A,16A 'cve':12A,15A 'endpoint':6A 'exhaust':10A 'let':7A 'pgedg':1A 'queri':5A 'rag':2A 'remot':8A 'resourc':11A 'server':3A 'unauthent':4A 'user':9A","search_b":"'ai':19B 'ai-tool':18B 'api':38B 'attack':81B 'augment':36B 'bm25':57B 'corpus':47B 'cpu':85B 'databas':84B 'default':78B 'endpoint':65B 'entir':45B 'everi':60B 'exhaust':83B 'filter':46B 'generat':37B 'host':29B 'hybrid':73B 'in-memori':54B 'index':58B 'inexpens':90B 'limit':50B,71B 'memori':56B 'pgedg':22B,30B 'pgedge-rag-serv':21B 'pgvector':25B,42B 'postgresql':26B,40B 'queri':64B,91B 'rag':23B,31B 'rate':70B 'read':43B 'rebuild':52B 'remot':80B 'request':61B 'resourc':88B 'retriev':35B 'retrieval-aug':34B 'search':74B 'self':28B 'self-host':27B 'server':24B,32B 'servic':87B 'tool':20B 'unauthent':67B","search_c":"'2.0.0':111C,178C 'api':97C 'augment':102C 'bm25':135C 'content':106C 'corpus':125C,166C 'cpu':162C 'databas':160C 'default':145C 'endpoint':115C,150C 'entir':123C 'everi':138C 'exhaust':169C 'fetchdocu':117C 'filter':124C 'fix':175C 'generat':103C 'hybriden':141C 'impos':159C 'in-memori':132C 'index':136C 'inexpens':155C 'internal/config/loader.go':147C 'internal/database/search.go':119C 'issu':173C 'limit':128C,154C 'memori':134C 'pgedg':92C 'pgvector':108C 'postgresql':105C 'prior':109C 'proport':164C 'queri':114C,157C 'rag':93C 'rate':153C 'read':121C 'rebuild':130C 'remot':156C 'request':139C 'resourc':171C 'retriev':101C 'retrieval-aug':100C 'server':94C,98C 'servic':170C 'set':143C 'size':167C 'unauthent':113C 'use':107C,116C 'version':177C 'without':126C 'work':163C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-03T12:43:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125327","severity":null,"published_at":"2026-11-10T19:21:09+00:00","modified_at":"2026-11-10T19:21:09+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","fetched_at":"2026-11-10T19:25:14+00:00","note":null}],"documents":[{"id":116908,"url":"https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116909,"url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":117482,"url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T12:43:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}