CVE-2026-125326: pgEdge RAG Server: API key fragment leak via error text

Q: Is CVE-2026-125326 actively exploited?

No confirmed active exploitation of CVE-2026-125326 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-125326?

1) Upgrade pgEdge RAG Server to 2.0.0 or later (fix in PR #45 and commit 72e0785). 2) Rotate LLM provider API keys used by any instance that was reachable by untrusted clients. 3) Place the query API behind authentication, an API gateway or a private network until patched. 4) Review logs for repeated failed-provider queries or bursts of error responses from unknown sources. 5) Review provider-side usage dashboards for unexpected activity and set spend limits. 6) Scrub or generalize upstream error messages in any wrapper or proxy in front of the service.

Q: What systems are affected by CVE-2026-125326?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, vector databases, LLM API gateways.

Q: What is the CVSS score for CVE-2026-125326?

CVE-2026-125326 has a CVSS v3.1 base score of 5.8 (MEDIUM). The EPSS exploitation probability is 0.41%.

GHSA-68g8-gh8f-7rhgMEDIUM

Published November 10, 2026

CISO Take

pgEdge RAG Server versions before 2.0.0 expose an unauthenticated query API that returns raw LLM provider error messages, which can quote a partially masked copy of the operator's third-party API key. Any remote caller can trigger an authentication failure and read part of the credential, so the exposure requires no privileges or user interaction. Severity is medium (CVSS 5.8) with no KEV listing, no public exploit, no Nuclei template and no EPSS data, so mass exploitation looks unlikely right now. A partial key still lowers the effort of brute-forcing or correlating the credential and confirms which provider account is in use, and the scope change in the CVSS vector reflects impact beyond the RAG server itself. Upgrade to 2.0.0 or later, rotate any provider keys used by exposed instances, and restrict network access to the query API until the upgrade is complete.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium overall. Exploitation is trivial (network, low complexity, no privileges, no interaction), but impact is limited to partial confidentiality loss (C:L) of a masked credential. No known exploitation, exploit code, scanner template, or KEV listing exists, and EPSS data is unavailable. Risk rises for internet-exposed instances whose provider keys have high spend limits or broad scopes, and when the error text reveals enough characters to aid guessing or to identify the key in other leaks.

How does the attack unfold?

Initial Access

The attacker reaches the unauthenticated query API of an exposed pgEdge RAG Server over the network.

AML.T0049

Trigger Error

The attacker sends a request that causes the LLM provider call to fail authentication, so the provider returns error text.

AML.T0049

Credential Leak

The server returns the raw provider error, which quotes a partially masked API key.

AML.T0082

Impact

The attacker uses the key fragment to aid brute-forcing or correlation against the operator's provider account, risking unauthorized use and cost.

Initial Access

The attacker reaches the unauthenticated query API of an exposed pgEdge RAG Server over the network.

AML.T0049

Trigger Error

The attacker sends a request that causes the LLM provider call to fail authentication, so the provider returns error text.

AML.T0049

Credential Leak

The server returns the raw provider error, which quotes a partially masked API key.

AML.T0082

Impact

The attacker uses the key fragment to aid brute-forcing or correlation against the operator's provider account, risking unauthorized use and cost.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenAI Node	go	< 1.0.1-0.20260729022402-72e0785a6d7c	`1.0.1-0.20260729022402-72e0785a6d7c`
11.3K1.8K dependentsPushed 6d ago54% patched~133d to patchFull package profile →
pgvector	pip	—	No patch
1.5K433 dependentsPushed 8d ago40% patched~13d to patchFull package profile →
pgedge-rag-server	—	—	No patch

How severe is it?

CVSS 3.1

5.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SChanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade pgEdge RAG Server to 2.0.0 or later (fix in PR #45 and commit 72e0785). 2) Rotate LLM provider API keys used by any instance that was reachable by untrusted clients. 3) Place the query API behind authentication, an API gateway or a private network until patched. 4) Review logs for repeated failed-provider queries or bursts of error responses from unknown sources. 5) Review provider-side usage dashboards for unexpected activity and set spend limits. 6) Scrub or generalize upstream error messages in any wrapper or proxy in front of the service.

How is it classified?

Data LeakageData ExtractionRAGAPIAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0082- RAG Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-125326?

Is CVE-2026-125326 actively exploited?

No confirmed active exploitation of CVE-2026-125326 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-125326?

1) Upgrade pgEdge RAG Server to 2.0.0 or later (fix in PR #45 and commit 72e0785). 2) Rotate LLM provider API keys used by any instance that was reachable by untrusted clients. 3) Place the query API behind authentication, an API gateway or a private network until patched. 4) Review logs for repeated failed-provider queries or bursts of error responses from unknown sources. 5) Review provider-side usage dashboards for unexpected activity and set spend limits. 6) Scrub or generalize upstream error messages in any wrapper or proxy in front of the service.

What systems are affected by CVE-2026-125326?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, vector databases, LLM API gateways.

What is the CVSS score for CVE-2026-125326?

CVE-2026-125326 has a CVSS v3.1 base score of 5.8 (MEDIUM). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesvector databasesLLM API gateways

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0082RAG Credential Harvesting

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.

Exploitation Scenario

An attacker discovers an internet-exposed pgEdge RAG Server query endpoint. They send queries in a way that makes the downstream LLM provider reject the call (for example when the operator's key is invalid, expired or rate-limited, or the request is malformed). The server returns the provider's error text in the HTTP response, quoting a partially masked API key. The attacker collects fragments across responses, correlates them with leaked keys or uses them to narrow guessing, and then targets the operator's provider account.

Weaknesses (CWE)

CWE-209Generation of Error Message Containing Sensitive InformationPrimary CWE-209Generation of Error Message Containing Sensitive InformationPrimary CWE-522Insufficiently Protected CredentialsPrimary CWE-522Insufficiently Protected CredentialsPrimary CWE-209Generation of Error Message Containing Sensitive Information CWE-522Insufficiently Protected Credentials

CWE-209 — Generation of Error Message Containing Sensitive Information: The product generates an error message that includes sensitive information about its environment, users, or associated data.

[Implementation] Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
[Implementation] Handle exceptions internally and do not display errors containing potentially sensitive information to a user.

Source: MITRE CWE corpus.