CVE-2026-125327

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.

• CWE-405
• CWE-770

• https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84
• https://github.com/pgEdge/pgedge-rag-server/pull/44
• https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0
• https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125320pgEdge Postgres MCP Server enables SQL queries against Postg…5.3
• CVE-2026-125321pgEdge Postgres MCP Server enables SQL queries against Postg…6.5
• CVE-2026-125322pgEdge Postgres MCP Server enables SQL queries against Postg…6.5
• CVE-2026-125323pgEdge Control Plane is a distributed application for managi…7.8
• CVE-2026-125325pgEdge RAG Server is an API server for retrieval-augmented g…5.9
• CVE-2026-125326pgEdge RAG Server is an API server for retrieval-augmented g…5.8
• CVE-2026-125328pgEdge Go LLM Library provides a unified Go interface for mu…5.8
• CVE-2026-125329Kaneo is a project management application with boards, Gantt…8.4
• CVE-2026-125330HarnessRouter is a self-hosted unified API for agent harness…7.5
• CVE-2026-125331HarnessRouter is a self-hosted unified API for running agent…9.1
• CVE-2026-125332Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-125333Forge (also called node-forge) is a native implementation of…5.9