{"id":"EM-20261112-0B86","url":"https://cyber.eventmonitor.net/incident/EM-20261112-0B86/pgedge-rag-server-vulnerability-cve-2026-125327/","type":"cve","title":"pgEdge RAG Server Vulnerability (CVE-2026-125327)","subtitle":"CVE-2026-125327","subject":"CVE-2026-125327","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-12T20:37:38.000Z","firstSignal":"2026-11-10T19:21:09.977Z","lastSignal":"2026-11-12T20:37:38.000Z","updated":"2026-11-12T21:34:18.238Z","revision":1,"life":[{"status":"Born","at":"2026-11-12T20:37:38.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-12T20:37:38.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T19:21:09.977Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-12T20:37:38.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261112-0B86 created."}],"stages":[{"name":"Disclosed","at":"2026-11-10T19:21:09.977Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T19:21:09.977Z","detail":"CVSS 7.5 · EPSS 0.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T19:21:09.977Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-125327 (CVSS 7.5)","text":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125327"},{"at":"2026-11-12T20:37:38.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-5qg5-rgp6-j5m5 / CVE-2026-125327: pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests","text":"go:github.com/pgEdge/pgedge-rag-server","url":"https://github.com/advisories/GHSA-5qg5-rgp6-j5m5"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T19:21:09.977","score":7.5,"severity":"HIGH","desc":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index…","product":"","seen":1794519258238},"kev":null,"epss":{"epss":0.00446,"pct":0.39278,"at":1794519258238},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}