pgEdge RAG Server: Cross-tenant data disclosure via shared BM25 index
Summary
pgEdge RAG Server before 2.0.0 keeps a single BM25 keyword index per pipeline, and this index is shared by the unauthenticated query endpoint. Because the clear, refill and search steps are locked separately, concurrent requests can interleave, so one request may search documents loaded through another request's filter. This can return documents belonging to a different tenant or customer, without any malformed input, and the affected responses cannot be identified from server logs.
Affected
- pgEdge pgedge-rag-server versions before 2.0.0
Fixed in
- Version 2.0.0 and later
Workaround
Unknown. The vendor sources point only to upgrading. Until the upgrade is done, restrict network access to the query endpoint to trusted callers.
Exploitation
- Not known to be exploited at the time of research.
- No CISA KEV entry found.
- No public proof of concept found at the time of research.
Our recommendation
- Inventory all pgedge-rag-server instances and check their versions.
- Upgrade affected instances to 2.0.0 or later.
- Until the upgrade is done, do not expose the query endpoint to the internet and limit access to trusted callers.
- If a multi-tenant instance was reachable while affected, assess possible cross-customer disclosure, including obligations under the Swiss FADP, because the affected responses cannot be identified from logs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-w437-9mwm-j6vq github.com
- CVE Record CVE-2026-125325 www.cve.org
- Fix commit a09d487 github.com
- Pull Request #44 github.com
- Release v2.0.0 github.com
- OffSeq threat entry CVE-2026-125325 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:34.
Original description (NVD)
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.