CVE-2026-125325: pgEdge RAG Server: race condition leaks cross-tenant docs

MEDIUM

Published November 10, 2026

CISO Take

pgEdge RAG Server before 2.0.0 shares a single BM25 keyword index per pipeline across concurrent requests on its unauthenticated query endpoint, so one request can search a corpus that was populated by another request's search filter. This can return documents belonging to a different tenant or customer, and because the affected responses cannot be identified retrospectively from server logs, you cannot reliably scope who saw what after the fact. Risk is moderated by a CVSS of 5.9 (high attack complexity, confidentiality-only impact), no EPSS data, no CISA KEV listing, no public exploit and no Nuclei template, and downstream adoption is unknown. Still, any multi-tenant RAG deployment holding customer-segregated or regulated data should treat this as a potential data-breach and compliance concern. Upgrade to v2.0.0 (GHSA-w437-9mwm-j6vq) and restrict network access to the query endpoint until then.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium overall (CVSS 3.1: 5.9). Network-reachable with no privileges or user interaction, but exploitation depends on a race between concurrent requests (high attack complexity). Impact is limited to confidentiality, but that includes cross-tenant document disclosure. The query endpoint is unauthenticated, which raises exposure when it is internet-facing. No known exploitation, no KEV listing, no public exploit and no EPSS score is available, so near-term likelihood appears low. The lack of forensic traceability raises the compliance and incident-response risk beyond what the CVSS suggests. Multi-tenant deployments face the highest risk.

How does the attack unfold?

Initial Access

Attacker reaches the unauthenticated query endpoint of an exposed pgEdge RAG Server.

AML.T0049

Exploitation

Concurrent queries race on the shared BM25 index so a search runs against another request's filtered corpus.

AML.T0085.000

Collection

Attacker repeats requests and collects returned documents belonging to other tenants.

AML.T0036

Impact

Confidential tenant data is disclosed with no log trail to identify affected responses.

AML.T0048.003

Initial Access

Attacker reaches the unauthenticated query endpoint of an exposed pgEdge RAG Server.

AML.T0049

Exploitation

Concurrent queries race on the shared BM25 index so a search runs against another request's filtered corpus.

AML.T0085.000

Collection

Attacker repeats requests and collects returned documents belonging to other tenants.

AML.T0036

Impact

Confidential tenant data is disclosed with no log trail to identify affected responses.

AML.T0048.003

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
pgedge-rag-server	—	—	No patch

Do you use pgedge-rag-server? You're affected.

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade pgEdge RAG Server to v2.0.0 or later (see PR #44 and commit a09d487). 2) Until patched, put the query endpoint behind authentication or a gateway and limit it to trusted networks. 3) For multi-tenant use, deploy separate pipelines or instances per tenant so no BM25 index is shared. 4) Serialize or rate-limit concurrent queries on affected pipelines as a stopgap. 5) Add request-level logging of returned document IDs and tenant identifiers, because existing logs cannot reconstruct exposure. 6) Review whether tenant-segregated data was served on affected versions and involve privacy/legal teams if sensitive data was in scope.

How is it classified?

Data LeakageData ExtractionRAGAPIAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0085.000- RAG Databases

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM08-Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-125325?

Is CVE-2026-125325 actively exploited?

No confirmed active exploitation of CVE-2026-125325 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-125325?

1) Upgrade pgEdge RAG Server to v2.0.0 or later (see PR #44 and commit a09d487). 2) Until patched, put the query endpoint behind authentication or a gateway and limit it to trusted networks. 3) For multi-tenant use, deploy separate pipelines or instances per tenant so no BM25 index is shared. 4) Serialize or rate-limit concurrent queries on affected pipelines as a stopgap. 5) Add request-level logging of returned document IDs and tenant identifiers, because existing logs cannot reconstruct exposure. 6) Review whether tenant-segregated data was served on affected versions and involve privacy/legal teams if sensitive data was in scope.

What systems are affected by CVE-2026-125325?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, vector databases, multi-tenant AI applications, hybrid search (BM25 + vector).

What is the CVSS score for CVE-2026-125325?

CVE-2026-125325 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesvector databasesmulti-tenant AI applicationshybrid search (BM25 + vector)

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0085.000RAG Databases

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM08

What are the technical details?

Original Advisory

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0.

Exploitation Scenario

An attacker finds an exposed pgEdge RAG Server query endpoint backing a multi-tenant SaaS assistant. They send a steady stream of concurrent queries with varied filters while legitimate tenants are also querying. When the attacker's search lands between another request's clear and refill steps, it runs against that tenant's filtered corpus and returns their documents. The attacker repeats this to harvest snippets of confidential content, and because the server logs cannot attribute the leaked responses, the victim may never detect it.

Weaknesses (CWE)

CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationPrimary CWE-488Exposure of Data Element to Wrong SessionPrimary CWE-362Concurrent Execution using Shared Resource with Improper Synchronization CWE-488Exposure of Data Element to Wrong Session

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization: The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

[Architecture and Design] In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
[Architecture and Design] Use thread-safe capabilities such as the data access abstraction in Spring.

Source: MITRE CWE corpus.