CVE-2026-125328 pgEdge Go LLM Library discloses provider API key fragments in error messages
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125328?
CVE-2026-125328 is a medium-severity vulnerability in pgedge-go-llm-lib, published on 10 Nov 2026.
Official description
pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0.
Which versions are affected by CVE-2026-125328?
1 open source package ship an affected version, including github.com/pgEdge/pgedge-go-llm-lib.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pgEdge/pgedge-go-llm-lib Go | All versions | 0.1.2-0.20260729024727-7531a55d368b |
How do I fix CVE-2026-125328?
Upgrade github.com/pgEdge/pgedge-go-llm-lib to 0.1.2-0.20260729024727-7531a55d368b or later.
Is CVE-2026-125328 being exploited?
There is no known exploitation of CVE-2026-125328 in the wild and no public exploit code.
Sources
Also known as GHSA-8835-xmqj-354h.