CVE-2026-125328

Name of the Vulnerable Software and Affected Versions pgEdge Go LLM Library versions 0.1.0 through 0.1.x

Description The software contains an issue where the handleHealth() function in llm/proxy/handlers.go pings providers using the operator's actual credentials and returns the resulting error text. Additionally, the Authorize hook in llm/proxy/proxy.go allows access by default if the consuming application does not configure it. Consequently, a remote caller accessing the 'GET /v1/health' endpoint can obtain portions of the operator's third-party provider API key if the provider rejects the configured credential.

Recommendations Update to version 0.2.0.