PT-2026-144093

CVE-2026-125326

Published

2026-11-10

Updated

2026-11-12

Description by

CVSS 3.1

5.8

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions pgEdge RAG Server versions prior to 2.0.0

Description The unauthenticated query API in internal/server/handlers.go returns error messages from failed LLM provider calls. These responses can include provider-controlled text that quotes a partially masked API key. A remote caller can trigger an authentication failure to obtain a portion of the operator's credentials for the third-party provider account via the query API error response.

Recommendations Update to version 2.0.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Antthelimey

Vendors

Affected products

Weakness enumeration

CWE-209: Generation of Error Message Containing Sensitive Information

CWE-522: Insufficiently Protected Credentials