Skip to content
OpenAdvisories

Package · Go

github.com/pgEdge/pgedge-rag-server

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-125327

    pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests

    pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LI…

    pgEdge pgedge-rag-server github.com/pgEdge/pgedge-rag-server Go
  • Medium 5.8
    CVE-2026-125326

    pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages

    pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-…

    pgEdge pgedge-rag-server github.com/pgEdge/pgedge-rag-server Go
  • Medium 5.9
    CVE-2026-125325

    pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests

    pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its…

    pgEdge pgedge-rag-server github.com/pgEdge/pgedge-rag-server Go