CVE-2026-125328

A pgEdge proxy health response could reveal part of an LLM provider key

pgEdge · Go LLM Library provider proxy

First documented disclosure · Review checkpoint

Summary

The health check forwarded provider authentication errors containing credential fragments. A caller could obtain part of the operator's provider credential.

Severity and exploitation evidence

Medium · 5.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The health check forwarded provider authentication errors containing credential fragments.

Conditions required

The proxy health service was reachable and an upstream provider rejected its configured credential.

Potential impact

A caller could obtain part of the operator's provider credential.

Affected versions and configurations

0.1.0 through versions before 0.2.0.

Fix and mitigation status

0.2.0.

Practical next steps

Update the Go LLM library and configure authorization on exposed proxy routes.

Operating lesson

Give AI retrieval and tool services database credentials scoped to the data they need.

Evidence and limits

The public disclosure was on 2026-09-03. The CVE record was published on 2026-11-10.

Sources