{"id":"CVE-2026-125328","aliases":["EUVD-2026-121710","GHSA-8835-xmqj-354h"],"status":"published","title":"pgEdge Go LLM Library discloses provider API key fragments in error messages","description":"pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00291,"percentile":0.21941,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-209","CWE-522"],"published":"2026-11-10T18:05:20.491Z","modified":"2026-11-12T19:45:03Z","fixes":[{"ecosystem":"Go","package":"github.com/pgEdge/pgedge-go-llm-lib","fixed_in":["0.1.2-0.20260729024727-7531a55d368b"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/pgEdge/pgedge-go-llm-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-0.20260729024727-7531a55d368b"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/pgEdge/pgedge-go-llm-lib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.2-0.20260729024727-7531a55d368b"}]}]}],"products":[{"vendor":"pgedge","product":"pgedge-go-llm-lib"}],"references":[{"url":"https://github.com/pgEdge/pgedge-go-llm-lib/security/advisories/GHSA-8835-xmqj-354h","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/pgEdge/pgedge-go-llm-lib/pull/26","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/7531a55d368b3a29cd173c792cc4609c4134b076","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/8bb9a6380d5f8db0124b51605759897034ad4da1","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/pgEdge/pgedge-go-llm-lib/releases/tag/v0.2.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125328","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8835-xmqj-354h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125328.json","tags":["advisory"]},{"url":"https://github.com/pgEdge/pgedge-go-llm-lib","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-125328","title":"pgEdge Go LLM Library discloses provider API key fragments in error messages","description":"pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0.","status":"published","published":"2026-11-10T18:05:20.491Z","modified":"2026-11-10T18:05:20.491Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-209","CWE-522"],"updated_at":"2026-11-10T19:39:59.389041Z"}],"euvd":[{"id":"EUVD-2026-121710","description":"pgEdge Go LLM Library discloses provider API key fragments in error messages","status":"published","published":"2026-11-12T19:32:36Z","modified":"2026-11-12T19:32:36Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-12T20:34:56.031921Z"}],"ghsa":[{"id":"GHSA-8835-xmqj-354h","title":"pgEdge Go LLM Library discloses provider API key fragments in error messages","description":"### Impact\n\nAn unauthenticated caller could read part of the operator's configured LLM provider API key.\n\nThe library's own health handler pings every configured provider using the operator's real credential and returns the resulting error text verbatim. Providers characteristically quote a partially masked form of the credential they rejected, so a failing ping published a fragment of\nthe key.\n\n**The endpoint is unauthenticated by default.** `authorize()` returns\ntrue immediately when the consuming application sets no `Authorize` hook,\nso `GET /v1/health` is reachable by anyone who can reach the listening\nport unless the consumer opted in to authentication.\n\n**Who is affected:** any application embedding pgedge-go-llm-lib at\n`0.1.0` or `0.1.1` that exposes the bundled HTTP proxy without setting an\n`Authorize` hook. Both affected versions are released tags and resolve\nthrough the public Go module proxy.\n\nThe disclosed material authenticates to a **third-party provider\naccount** rather than to pgEdge software, which is why the severity\ncarries Scope: Changed.\n\nEvidence at `v0.1.1`: `llm/proxy/handlers.go:296` (`handleHealth`\nreturning `err.Error()` in `ProviderHealth.Error`), `llm/proxy/proxy.go:247`\n(`authorize()` defaulting to permit), and `llm/proxy/proxy.go:350`\n(`writeError` writing the error with no redaction).\n\n### Patches\n\n**Fixed in `0.2.0`. Upgrade to `0.2.0` or later**, which redacts\ncredentials from provider error messages unconditionally. The fix adds\n`llm/internal/redact`, with a follow-up anchoring word boundaries, and is\npinned by tests in that package.\n\n**Note the version.** There is no `0.1.2` — it was never cut, and some\nearlier material named it in error. `0.2.0` is the first fixed release.\n\n**Upgrading does not undo a disclosure that already happened. Rotate any\nLLM provider credential configured on an affected version** where the\nproxy was reachable without an `Authorize` hook, particularly if a\nprovider was rejecting that key at the time.\n\n### Workarounds\n\nSet an `Authorize` hook on the proxy, which closes the unauthenticated\nroute to the health endpoint. Restricting network access to the listening\nport limits who can reach it. Neither removes the underlying disclosure\nfor a caller who does reach the endpoint.","status":"published","published":"2026-11-12T19:32:36Z","modified":"2026-11-12T19:32:37Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209","CWE-522"],"updated_at":"2026-11-12T19:42:54.373923Z"}],"nvd":[{"id":"CVE-2026-125328","description":"pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0.","status":"published","published":"2026-11-10T19:21:10.13Z","modified":"2026-11-12T22:18:51.47Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-209","CWE-522"],"updated_at":"2026-11-10T22:21:33.392456Z"}],"osv":[{"id":"CVE-2026-125328","title":"pgEdge Go LLM Library discloses provider API key fragments in error messages","description":"pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0.","status":"published","published":"2026-11-10T18:05:20.491Z","modified":"2026-11-12T02:48:34.856871308Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209","CWE-522"],"updated_at":"2026-11-12T03:30:48.739835Z"},{"id":"GHSA-8835-xmqj-354h","title":"pgEdge Go LLM Library discloses provider API key fragments in error messages","description":"### Impact\n\nAn unauthenticated caller could read part of the operator's configured LLM provider API key.\n\nThe library's own health handler pings every configured provider using the operator's real credential and returns the resulting error text verbatim. Providers characteristically quote a partially masked form of the credential they rejected, so a failing ping published a fragment of\nthe key.\n\n**The endpoint is unauthenticated by default.** `authorize()` returns\ntrue immediately when the consuming application sets no `Authorize` hook,\nso `GET /v1/health` is reachable by anyone who can reach the listening\nport unless the consumer opted in to authentication.\n\n**Who is affected:** any application embedding pgedge-go-llm-lib at\n`0.1.0` or `0.1.1` that exposes the bundled HTTP proxy without setting an\n`Authorize` hook. Both affected versions are released tags and resolve\nthrough the public Go module proxy.\n\nThe disclosed material authenticates to a **third-party provider\naccount** rather than to pgEdge software, which is why the severity\ncarries Scope: Changed.\n\nEvidence at `v0.1.1`: `llm/proxy/handlers.go:296` (`handleHealth`\nreturning `err.Error()` in `ProviderHealth.Error`), `llm/proxy/proxy.go:247`\n(`authorize()` defaulting to permit), and `llm/proxy/proxy.go:350`\n(`writeError` writing the error with no redaction).\n\n### Patches\n\n**Fixed in `0.2.0`. Upgrade to `0.2.0` or later**, which redacts\ncredentials from provider error messages unconditionally. The fix adds\n`llm/internal/redact`, with a follow-up anchoring word boundaries, and is\npinned by tests in that package.\n\n**Note the version.** There is no `0.1.2` — it was never cut, and some\nearlier material named it in error. `0.2.0` is the first fixed release.\n\n**Upgrading does not undo a disclosure that already happened. Rotate any\nLLM provider credential configured on an affected version** where the\nproxy was reachable without an `Authorize` hook, particularly if a\nprovider was rejecting that key at the time.\n\n### Workarounds\n\nSet an `Authorize` hook on the proxy, which closes the unauthenticated\nroute to the health endpoint. Restricting network access to the listening\nport limits who can reach it. Neither removes the underlying disclosure\nfor a caller who does reach the endpoint.","status":"published","published":"2026-11-12T19:32:36Z","modified":"2026-11-12T19:45:03.182304314Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209","CWE-522"],"updated_at":"2026-11-12T20:14:41.935484Z"}]}}