CVE-2026-125326

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.

• CWE-209
• CWE-522

• https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61
• https://github.com/pgEdge/pgedge-rag-server/pull/45
• https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0
• https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12530Improper neutralization of argument delimiters in the instal…7.3
• CVE-2026-125320pgEdge Postgres MCP Server enables SQL queries against Postg…5.3
• CVE-2026-125321pgEdge Postgres MCP Server enables SQL queries against Postg…6.5
• CVE-2026-125322pgEdge Postgres MCP Server enables SQL queries against Postg…6.5
• CVE-2026-125323pgEdge Control Plane is a distributed application for managi…7.8
• CVE-2026-125325pgEdge RAG Server is an API server for retrieval-augmented g…5.9
• CVE-2026-125327pgEdge RAG Server is an API server for retrieval-augmented g…7.5
• CVE-2026-125328pgEdge Go LLM Library provides a unified Go interface for mu…5.8
• CVE-2026-125329Kaneo is a project management application with boards, Gantt…8.4
• CVE-2026-125330HarnessRouter is a self-hosted unified API for agent harness…7.5
• CVE-2026-125331HarnessRouter is a self-hosted unified API for running agent…9.1
• CVE-2026-125332Forge (also called node-forge) is a native implementation of…5.9