pgEdge pgedge-go-llm-lib up to 0.1.x Health Check llm/proxy/handlers.go handleHealth improper authorization

Summaryinfo

A vulnerability, which was classified as problematic, was found in pgEdge pgedge-go-llm-lib up to 0.1.x. This affects the function handleHealth of the file llm/proxy/handlers.go of the component Health Check. Executing a manipulation can lead to improper authorization. This vulnerability is tracked as CVE-2026-125328. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in pgEdge pgedge-go-llm-lib up to 0.1.x and classified as problematic. This vulnerability affects the function handleHealth of the file llm/proxy/handlers.go of the component Health Check. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality. CVE summarizes:

pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0.

The advisory is available at github.com. This vulnerability was named CVE-2026-125328 since 11/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

Upgrading to version 0.2.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• pgEdge

Name

• pgedge-go-llm-lib

Version

• 0.1

Website

• Product: https://github.com/pgEdge/pgedge-go-llm-lib/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion