{"id":"CVE-2026-125326","aliases":["EUVD-2026-121708","GHSA-68g8-gh8f-7rhg"],"status":"published","title":"pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages","description":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00411,"percentile":0.35834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-209","CWE-522"],"published":"2026-11-10T18:01:18.698Z","modified":"2026-11-12T20:45:03Z","fixes":[{"ecosystem":"Go","package":"github.com/pgEdge/pgedge-rag-server","fixed_in":["1.0.1-0.20260729022402-72e0785a6d7c"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/pgEdge/pgedge-rag-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-0.20260729022402-72e0785a6d7c"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/pgEdge/pgedge-rag-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1-0.20260729022402-72e0785a6d7c"}]}]}],"products":[{"vendor":"pgedge","product":"pgedge-rag-server"}],"references":[{"url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/pgEdge/pgedge-rag-server/pull/45","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125326","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-68g8-gh8f-7rhg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125326.json","tags":["advisory"]},{"url":"https://github.com/pgEdge/pgedge-rag-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-125326","title":"pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages","description":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.","status":"published","published":"2026-11-10T18:01:18.698Z","modified":"2026-11-10T20:59:21.803Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-209","CWE-522"],"updated_at":"2026-11-10T18:39:47.416646Z"}],"euvd":[{"id":"EUVD-2026-121708","description":"pgEdge RAG Server discloses part of the configured provider credential through API error messages","status":"published","published":"2026-11-12T20:29:32Z","modified":"2026-11-12T20:29:32Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-12T21:35:37.291345Z"}],"ghsa":[{"id":"GHSA-68g8-gh8f-7rhg","title":"pgEdge RAG Server discloses part of the configured provider credential through API error messages","description":"### Impact\n\nAn unauthenticated remote caller could read part of the operator's configured LLM provider API key.\n\nThe query API relayed the text of a provider error straight to the caller. That text carried the upstream provider's own message, and providers characteristically quote a partially masked form of the credential they rejected when authentication fails — so a failing provider call published a fragment of the operator's key. A caller who can reach the endpoint can cause such a failure and read the result.\n\n**Who is affected:** any deployment of pgEdge RAG Server at `1.0.0` or earlier, including all alpha and beta pre-releases, whose query endpoint was reachable by an untrusted party. The endpoint carries no authentication in the affected versions.\n\nThe disclosed material authenticates to a **third-party provider account** rather than to pgEdge software, which is why the severity carries Scope: Changed.\n\n`v1.0.0:internal/server/handlers.go:121` relayed `err.Error()` to the client when pipeline execution failed. `parseError` in\n`v1.0.0:internal/llm/openai/client.go` produced that error by two routes, and both disclose:\n\n```go\nvar errResp ErrorResponse\nif err := json.Unmarshal(body, \u0026errResp); err != nil {\n    return fmt.Errorf(\"API error (status %d): %s\", resp.StatusCode, string(body))\n}\nreturn fmt.Errorf(\"API error (status %d): %s\", resp.StatusCode, errResp.Error.Message)\n```\n\nThe first branch interpolates the entire unparsed response body. The second returns the provider's own message, which for OpenAI quotes the `sk-proj-` prefix and the final four characters of the submitted key.\n\n### Patches\n\n**Fixed in `2.0.0`. Upgrade to `2.0.0` or later.**\n\nThe fix adds `internal/safeerr` and stops provider error text reaching API clients.\n\n**Upgrading does not undo the disclosure, and this needs action beyond upgrading. Rotate any LLM provider credential that was configured on an affected version while the endpoint was reachable by an untrusted caller**, particularly if that provider was rejecting the key at the time. A fragment already disclosed stays disclosed.\n\n### Workarounds\n\nPlace the server behind a proxy that rewrites 5xx response bodies, or terminate provider errors before they reach the API surface. Keeping provider credentials valid, so that no authentication failure is produced, also avoids the disclosure in practice.\n\nNone of these removes the underlying defect, and none is a substitute for upgrading.","status":"published","published":"2026-11-12T20:29:32Z","modified":"2026-11-12T20:29:36Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209","CWE-522"],"updated_at":"2026-11-12T20:43:14.1309Z"}],"nvd":[{"id":"CVE-2026-125326","description":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.","status":"published","published":"2026-11-10T18:17:34.01Z","modified":"2026-11-12T22:18:51.47Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-209","CWE-522"],"updated_at":"2026-11-10T20:21:09.613171Z"}],"osv":[{"id":"CVE-2026-125326","title":"pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages","description":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.","status":"published","published":"2026-11-10T18:01:18.698Z","modified":"2026-11-12T02:48:35.885308221Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209","CWE-522"],"updated_at":"2026-11-12T03:30:48.739835Z"},{"id":"GHSA-68g8-gh8f-7rhg","title":"pgEdge RAG Server discloses part of the configured provider credential through API error messages","description":"### Impact\n\nAn unauthenticated remote caller could read part of the operator's configured LLM provider API key.\n\nThe query API relayed the text of a provider error straight to the caller. That text carried the upstream provider's own message, and providers characteristically quote a partially masked form of the credential they rejected when authentication fails — so a failing provider call published a fragment of the operator's key. A caller who can reach the endpoint can cause such a failure and read the result.\n\n**Who is affected:** any deployment of pgEdge RAG Server at `1.0.0` or earlier, including all alpha and beta pre-releases, whose query endpoint was reachable by an untrusted party. The endpoint carries no authentication in the affected versions.\n\nThe disclosed material authenticates to a **third-party provider account** rather than to pgEdge software, which is why the severity carries Scope: Changed.\n\n`v1.0.0:internal/server/handlers.go:121` relayed `err.Error()` to the client when pipeline execution failed. `parseError` in\n`v1.0.0:internal/llm/openai/client.go` produced that error by two routes, and both disclose:\n\n```go\nvar errResp ErrorResponse\nif err := json.Unmarshal(body, \u0026errResp); err != nil {\n    return fmt.Errorf(\"API error (status %d): %s\", resp.StatusCode, string(body))\n}\nreturn fmt.Errorf(\"API error (status %d): %s\", resp.StatusCode, errResp.Error.Message)\n```\n\nThe first branch interpolates the entire unparsed response body. The second returns the provider's own message, which for OpenAI quotes the `sk-proj-` prefix and the final four characters of the submitted key.\n\n### Patches\n\n**Fixed in `2.0.0`. Upgrade to `2.0.0` or later.**\n\nThe fix adds `internal/safeerr` and stops provider error text reaching API clients.\n\n**Upgrading does not undo the disclosure, and this needs action beyond upgrading. Rotate any LLM provider credential that was configured on an affected version while the endpoint was reachable by an untrusted caller**, particularly if that provider was rejecting the key at the time. A fragment already disclosed stays disclosed.\n\n### Workarounds\n\nPlace the server behind a proxy that rewrites 5xx response bodies, or terminate provider errors before they reach the API surface. Keeping provider credentials valid, so that no authentication failure is produced, also avoids the disclosure in practice.\n\nNone of these removes the underlying defect, and none is a substitute for upgrading.","status":"published","published":"2026-11-12T20:29:32Z","modified":"2026-11-12T20:45:03.499008369Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209","CWE-522"],"updated_at":"2026-11-12T21:15:35.293334Z"}]}}