Skip to content
cve.newCreate a CVE report

github.com/pgEdge/pgedge-rag-server

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

github.com/pgEdge/pgedge-rag-server Go
Affected range Recorded fix
Earlier releases before 1.0.1-0.20260729020411-a09d4872356bSemantic versions1.0.1-0.20260729020411-a09d4872356b

Version evidence: OSV · GHSA-5qg5-rgp6-j5m5

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.1-0.20260729020411-a09d4872356b"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
medium5.8
CVE-2026-125326Package fixes recorded

pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages

An unauthenticated remote caller could read part of the operator's configured LLM provider API key.

Recorded fixes — github.com/pgEdge/pgedge-rag-server: 1.0.1-0.20260729022402-72e0785a6d7c. Check your release branch.

Exploitation not established

Go / github.com/pgEdge/pgedge-rag-server
github.com/pgEdge/pgedge-rag-server Go
Affected range Recorded fix
Earlier releases before 1.0.1-0.20260729022402-72e0785a6d7cSemantic versions1.0.1-0.20260729022402-72e0785a6d7c

Version evidence: OSV · GHSA-68g8-gh8f-7rhg

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.1-0.20260729022402-72e0785a6d7c"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
medium5.9
CVE-2026-125325Package fixes recorded

pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests

Documents belonging to one caller could be returned to another. Where an application passes a customer or tenant identifier as a search filter, that scoping could be defeated by ordinary concurrent traffic. No injection and no malformed input are required — normal load is enough.

Recorded fixes — github.com/pgEdge/pgedge-rag-server: 1.0.1-0.20260729020411-a09d4872356b. Check your release branch.

Exploitation not established

Go / github.com/pgEdge/pgedge-rag-server
github.com/pgEdge/pgedge-rag-server Go
Affected range Recorded fix
Earlier releases before 1.0.1-0.20260729020411-a09d4872356bSemantic versions1.0.1-0.20260729020411-a09d4872356b

Version evidence: OSV · GHSA-w437-9mwm-j6vq

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.1-0.20260729020411-a09d4872356b"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}