{"id":"CVE-2026-125328","kind":"vulnerability","aliases":["CVE-2026-125328"],"related":[],"title":"pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling,…","description":"pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0.","summary":null,"severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":[],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:10+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","triaged_at":null,"updated_at":"2026-11-10T19:39:26+00:00","category":null,"confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-125328':20A,23A '-2026':19A,22A '/v1/health':56C '0.1.0':52C '0.2.0':54C,131C 'access':82C 'api':119C 'applic':88C 'author':77C 'call':17A,40C 'caller':102C 'configur':91C,98C 'consum':87C 'credenti':69C,99C 'cve':18A,21A 'default':84C 'error':73C,124C 'event':49C 'fix':128C 'get':55C 'go':2A,8A,25C,31C 'handlehealth':60C 'hook':78C 'http':44C 'interfac':9A,32C 'issu':126C 'key':120C 'librari':4A,27C 'llm':3A,12A,26C,35C 'llm/proxy/handlers.go':58C 'llm/proxy/proxy.go':80C 'multipl':11A,34C 'obtain':109C 'oper':66C,113C 'part':110C 'parti':117C 'permit':81C 'pgedg':1A,24C 'ping':62C 'provid':5A,13A,28C,36C,63C,95C,118C 'proxi':50C,107C 'reach':105C 'real':68C 'reject':96C 'remot':101C 'result':123C 'retri':41C 'return':71C 'sent':48C 'server':47C 'server-s':46C 'stream':15A,38C 'text':74C 'third':116C 'third-parti':115C 'tool':16A,39C 'unifi':7A,30C 'use':59C 'version':130C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium"],"campaign_type":null,"search_a":"'-125328':20A,23A '-2026':19A,22A 'call':17A 'cve':18A,21A 'go':2A,8A 'interfac':9A 'librari':4A 'llm':3A,12A 'multipl':11A 'pgedg':1A 'provid':5A,13A 'stream':15A 'tool':16A 'unifi':7A","search_b":"","search_c":"'/v1/health':56C '0.1.0':52C '0.2.0':54C,131C 'access':82C 'api':119C 'applic':88C 'author':77C 'call':40C 'caller':102C 'configur':91C,98C 'consum':87C 'credenti':69C,99C 'default':84C 'error':73C,124C 'event':49C 'fix':128C 'get':55C 'go':25C,31C 'handlehealth':60C 'hook':78C 'http':44C 'interfac':32C 'issu':126C 'key':120C 'librari':27C 'llm':26C,35C 'llm/proxy/handlers.go':58C 'llm/proxy/proxy.go':80C 'multipl':34C 'obtain':109C 'oper':66C,113C 'part':110C 'parti':117C 'permit':81C 'pgedg':24C 'ping':62C 'provid':28C,36C,63C,95C,118C 'proxi':50C,107C 'reach':105C 'real':68C 'reject':96C 'remot':101C 'result':123C 'retri':41C 'return':71C 'sent':48C 'server':47C 'server-s':46C 'stream':38C 'text':74C 'third':116C 'third-parti':115C 'tool':39C 'unifi':30C 'use':59C 'version':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-03T12:39:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125328","severity":null,"published_at":"2026-11-10T19:21:10+00:00","modified_at":"2026-11-10T19:21:10+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","fetched_at":"2026-11-10T19:25:14+00:00","note":null}],"documents":[{"id":117483,"url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/7531a55d368b3a29cd173c792cc4609c4134b076","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117484,"url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/8bb9a6380d5f8db0124b51605759897034ad4da1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117485,"url":"https://github.com/pgEdge/pgedge-go-llm-lib/releases/tag/v0.2.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":117486,"url":"https://github.com/pgEdge/pgedge-go-llm-lib/security/advisories/GHSA-8835-xmqj-354h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T12:39:53+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}