CVE-2026-125326

pgEdge RAG errors could disclose part of a provider credential

pgEdge · RAG Server provider errors

First documented disclosure · Review checkpoint

Summary

Provider authentication errors were returned directly through the query service. Part of an operator’s provider key could be disclosed.

Severity and exploitation evidence

Medium · 5.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Provider authentication errors were returned directly through the query service.

Conditions required

The unauthenticated query service was reachable and a provider returned error text containing a partially masked key.

Potential impact

Part of an operator’s provider key could be disclosed.

Affected versions and configurations

Maintainer lists releases through 1.0.0. CNA describes versions before 2.0.0.

Fix and mitigation status

2.0.0.

Practical next steps

Upgrade RAG Server and review any exposed provider error responses.

Operating lesson

Give AI retrieval and tool services database credentials scoped to the data they need.

Evidence and limits

The public disclosure was on 2026-09-03. The CVE record was published on 2026-11-10.

Sources