{"data":{"id":"5f7496b5-8d58-4a9a-b084-832b94f9529c","title":"GHSA-68g8-gh8f-7rhg: pgEdge RAG Server discloses part of the configured provider credential through API error messages","summary":"Versions 1.0.0 and earlier of pgEdge RAG Server, including alpha and beta pre-releases, relay raw LLM provider error text to API clients through internal/server/handlers.go and parseError in internal/llm/openai/client.go. The endpoint has no authentication in those versions, so an unauthenticated caller who triggers a provider authentication failure can read a fragment of the operator's provider API key, such as the sk-proj- prefix and final four characters for OpenAI.","solution":"Fixed in 2.0.0. Upgrade to 2.0.0 or later. Upgrading does not undo prior disclosure, so rotate any LLM provider credential configured on an affected version while the endpoint was reachable by untrusted callers. Workarounds, which do not remove the defect: place the server behind a proxy that rewrites 5xx response bodies, or terminate provider errors before they reach the API surface; keeping provider credentials valid also avoids the disclosure in practice.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-68g8-gh8f-7rhg","publishedAt":"2026-11-12T20:29:32.000Z","cveId":"CVE-2026-125326","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":["github.com/pgEdge/pgedge-rag-server@< 1.0.1-0.20260729022402-72e0785a6d7c (fixed: 1.0.1-0.20260729022402-72e0785a6d7c)"],"affectedPackageNames":["github.com/pgedge/pgedge-rag-server"],"affectedPackageRefs":["go:github.com/pgedge/pgedge-rag-server"],"affectedVendors":["OpenAI"],"affectedVendorsRaw":["pgEdge RAG Server","OpenAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00411,"epssCheckedAt":"2026-11-13T00:12:55.040Z","kevDateAdded":null,"advisoryAliases":["GHSA-68g8-gh8f-7rhg"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-11-12T20:29:32.000Z","fixReleasedAt":"2026-07-29T02:24:02.000Z","daysToFix":-106,"fixCheckedAt":"2026-11-13T00:13:20.727Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"rag","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/pgEdge/pgedge-rag-server","fixedVersion":"1.0.1-0.20260729022402-72e0785a6d7c","matchedVersion":"v1.0.1-0.20260729022402-72e0785a6d7c","fixReleasedAt":"2026-07-29T02:24:02.000Z","daysToFix":-106,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-11-13T00:13:20.723Z"}]}}