pgEdge RAG Server reused a mutable BM25 keyword index across requests. Clearing, filling and searching that index under separate locks let concurrent tenant-filtered searches consult a different tenant's indexed documents. A concurrent request pattern is needed. Vector search and database document permission checks are not necessarily affected by the same…
Inspect the ClaimsCase · DiggingBeagle record
pgEdge RAG concurrent keyword searches could include another tenant's documents
pgEdge RAG Server reused a mutable BM25 keyword index across requests. Clearing, filling and searching that index under separate locks let concurrent tenant-filtered searches consult a different tenant's indexed documents. The security advisory documents the race but does not identify a particular customer document disclosed or retrospective logs proving actual cross-tenant responses.
Cross-session authorizationAgent authorityRetrieval authorization must follow each result into model context
Scope
A concurrent request pattern is needed. Vector search and database document permission checks are not necessarily affected by the same mechanism, but the keyword results can contaminate the context returned to an assistant.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
research_demonstration setting with demonstrated status, based on the identified primary disclosure and its stated test or incident limits. The new Claim distinguishes source observations from hypothetical downstream effects. Impact band is unassigned because the scoped evidence does not justify a comparable quantitative score; no unobserved customer harm or loss is imputed. Remediation state: patch_available.
Assessed Nov 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ENR243-024-DETAIL · CLM-R242-PGEDGE-RAG-CROSS-TENANT-BM25-LIMITS · CLM-R242-PGEDGE-RAG-CROSS-TENANT-BM25-MECHANISM · pgEdge RAG Server BM25 tenant isolation GHSA-w437-9mwm-j6vq
At a glance
The 2.0.0 fix creates a keyword index local to the request. Testing must confirm that tenant identity and authorization remain attached through every retrieval subsystem and cache.
Read the implicationsThe security advisory documents the race but does not identify a particular customer document disclosed or retrospective logs proving actual cross-tenant responses.
Limits and uncertaintyFull account
pgEdge RAG Server reused a mutable BM25 keyword index across requests. Clearing, filling and searching that index under separate locks let concurrent tenant-filtered searches consult a different tenant's indexed documents.
A concurrent request pattern is needed. Vector search and database document permission checks are not necessarily affected by the same mechanism, but the keyword results can contaminate the context returned to an assistant. The 2.0.0 fix creates a keyword index local to the request. Testing must confirm that tenant identity and authorization remain attached through every retrieval subsystem and cache.
The security advisory documents the race but does not identify a particular customer document disclosed or retrospective logs proving actual cross-tenant responses. Upgrade, isolate per-request indexes and replay concurrent requests with unique tenant markers and strict result audits.
Evidence reconciliation and effect boundary. A principal-specific filter can be correct when applied to the records selected for indexing, yet still fail when a shared working index changes between that selection and the final search. The resulting cross-tenant retrieval is a concurrency state-isolation problem, not a model hallucination. The vendor reports a fix based on per-request data structures and a concurrency regression test, but has not identified historical customer responses that definitely leaked documents.
Mechanism and trust boundary
- 01
A concurrent request pattern is needed. Vector search and database document permission checks are not necessarily affected by the same mechanism, but the keyword results can contaminate the context returned to an assistant.
- 02
The 2.0.0 fix creates a keyword index local to the request. Testing must confirm that tenant identity and authorization remain attached through every retrieval subsystem and cache.
Claims & evidence
CLM-ENR243-024-DETAILThe pgEdge RAG Server advisory attributes mixed-tenant keyword search results to a shared mutable BM25 index whose clear, populate and search stages were guarded by separate locks; the correction uses a per-request index.supported
Basis: reported finding
- supportspgEdge RAG Server BM25 tenant isolation GHSA-w437-9mwm-j6vqprimary disclosure
GHSA-w437-9mwm-j6vq, technical root cause, concurrent request test and fixed version
CLM-R242-PGEDGE-RAG-CROSS-TENANT-BM25-LIMITSThe security advisory documents the race but does not identify a particular customer document disclosed or retrospective logs proving actual cross-tenant responses.supported
Basis: reported finding
- supportspgEdge RAG Server BM25 tenant isolation GHSA-w437-9mwm-j6vqprimary disclosure
GHSA-w437-9mwm-j6vq, concurrency explanation, tenant filters and 2.0.0 fix
CLM-R242-PGEDGE-RAG-CROSS-TENANT-BM25-MECHANISMpgEdge RAG Server reused a mutable BM25 keyword index across requests. Clearing, filling and searching that index under separate locks let concurrent tenant-filtered searches consult a different tenant's indexed documents.supported
Basis: reported finding
- supportspgEdge RAG Server BM25 tenant isolation GHSA-w437-9mwm-j6vqprimary disclosure
GHSA-w437-9mwm-j6vq, concurrency explanation, tenant filters and 2.0.0 fix
Implications
The 2.0.0 fix creates a keyword index local to the request. Testing must confirm that tenant identity and authorization remain attached through every retrieval subsystem and cache.
Controls and mitigations
- Upgrade, isolate per-request indexes and replay concurrent requests with unique tenant markers and strict result audits.
Unknowns and contradictions
- The security advisory documents the race but does not identify a particular customer document disclosed or retrospective logs proving actual cross-tenant responses.
Sources and citation
Material revision history
- Nov 13, 2026 · Published version · first publication · revision 244