CVE-2026-125325

Name of the Vulnerable Software and Affected Versions pgEdge RAG Server versions prior to 2.0.0

Description An issue exists in the BM25 keyword index, which is a single per-pipeline object shared by the unauthenticated query endpoint. Because concurrent requests lock the clear, refill, and search operations separately, a request may search a corpus populated by another request's search filter. This can result in the disclosure of documents belonging to a different tenant or customer without requiring malformed input. Affected responses cannot be identified retrospectively from server logs.

Recommendations Update pgEdge RAG Server to version 2.0.0.