Is CVE-2026-125326 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125326 being exploited in the wild.

How severe is CVE-2026-125326?

Medium severity, with a CVSS score of 5.8, published 10 November 2026.

Which products and versions are affected?

github.com/pgEdge/pgedge-rag-server (Go) < 1.0.1-0.20260729022402-72e0785a6d7c; pgEdge RAG Server prior to 2.0.0.

Is there a fix for CVE-2026-125326?

Yes: fixed in 2.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125326 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-125326?

Check whether you run github.com/pgEdge/pgedge-rag-server (Go) or pgEdge RAG Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125326: pgEdge RAG Server credential leak in error responses

Q: Is there a fix for CVE-2026-125326?

Yes: fixed in 2.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-125326 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-125326?

Check whether you run github.com/pgEdge/pgedge-rag-server (Go) or pgEdge RAG Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125326 · Severity: medium · CVSS 5.8 · Published 2026-11-10

pgEdge RAG Server is an API for retrieval-augmented generation over PostgreSQL databases. The unauthenticated API returns detailed error messages from failed third-party provider calls, which inadvertently leak partial API keys and credentials for those providers. An attacker can trigger an authentication failure and harvest credential fragments through simple API requests.

Technologies: github.com/pgEdge/pgedge-rag-server (Go), pgEdge RAG Server. Vendors: Go, pgEdge.

Quick answers

Is CVE-2026-125326 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125326 being exploited in the wild.
How severe is CVE-2026-125326?: Medium severity, with a CVSS score of 5.8, published 10 November 2026.
Which products and versions are affected?: github.com/pgEdge/pgedge-rag-server (Go) < 1.0.1-0.20260729022402-72e0785a6d7c; pgEdge RAG Server prior to 2.0.0.
Is there a fix for CVE-2026-125326?: Yes: fixed in 2.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125326 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-125326?: Check whether you run github.com/pgEdge/pgedge-rag-server (Go) or pgEdge RAG Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.0.0

Technical details

The vulnerability exists in internal/server/handlers.go where unauthenticated query and health endpoints return raw error strings from LLM provider calls via err.Error(). Third-party providers (OpenAI, Anthropic, etc.) echo truncated API keys in their JSON error responses when rejecting credentials; these are preserved and returned to the caller. The health endpoint is particularly easy to exploit—a simple GET /v1/health request with an invalid configured key leaks the credential fragment without any query payload or authentication.

Affected products

pgEdge RAG Server prior to 2.0.0

Identifiers

CVE-2026-125326
GHSA-68g8-gh8f-7rhg

Timeline

2026-11-10: disclosed
2026-07-29: patched: Fix merged in pull request #45

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.