Threats tagged 'ghsa-68g8-gh8f-7rhg'

pgEdge RAG Server versions 1.0.0 and earlier expose part of the configured LLM provider API key through error messages returned by the query API. An unauthenticated remote attacker can trigger provider authentication failures that cause the server to relay upstream provider error messages containing partially masked credentials. This disclosure affects third-party provider accounts and has a scope change impact. The issue is fixed in version 2.0.0 by preventing provider error text from reaching API clients. Users should upgrade and rotate any exposed credentials.