Search

Find a vulnerability

Search criteria

    14 vulnerabilities found for pgedge-postgres-mcp by pgEdge

    CVE-2026-126199 (GCVE-0-2026-126199)

    Vulnerability from nvd – Published: 2026-11-12 17:32 – Updated: 2026-11-12 17:32
    VLAI
    Title
    pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query_database statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allow_writes connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
    CWE
    • CWE-357 - Insufficient UI Warning of Dangerous Operations
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query_database statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allow_writes connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-357",
              "description": "CWE-357: Insufficient UI Warning of Dangerous Operations",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:32:08.972Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-5gmh-9683-hhq9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-5gmh-9683-hhq9"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/233",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/233"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/310c02809891cfaee6e4891cd7bb9aa1d459575c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/310c02809891cfaee6e4891cd7bb9aa1d459575c"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5gmh-9683-hhq9",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-126199",
    "datePublished": "2026-11-12T17:32:08.972Z",
    "dateReserved": "2026-11-10T20:07:44.958Z",
    "dateUpdated": "2026-11-12T17:32:08.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-126198 (GCVE-0-2026-126198)

    Vulnerability from nvd – Published: 2026-11-12 17:31 – Updated: 2026-11-13 00:19
    VLAI
    Title
    pgEdge Postgres MCP Server custom tools performed writes without user confirmation
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0.
    Severity
    3.1 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-13 00:19 UTC
    CWE
    • CWE-357 - Insufficient UI Warning of Dangerous Operations
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126198",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T00:19:36.420416Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T00:19:49.261Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-357",
              "description": "CWE-357: Insufficient UI Warning of Dangerous Operations",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:31:01.420Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/198",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/198"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-v44x-hxg7-5cgc",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server custom tools performed writes without user confirmation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-126198",
    "datePublished": "2026-11-12T17:31:01.420Z",
    "dateReserved": "2026-11-10T20:07:44.957Z",
    "dateUpdated": "2026-11-13T00:19:49.261Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-126197 (GCVE-0-2026-126197)

    Vulnerability from nvd – Published: 2026-11-12 17:29 – Updated: 2026-11-13 18:57
    VLAI
    Title
    pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-13 18:57 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126197",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T18:57:00.288680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T18:57:22.759Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:29:35.883Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r5pp-jx86-r6r9",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-126197",
    "datePublished": "2026-11-12T17:29:35.883Z",
    "dateReserved": "2026-11-10T20:07:44.957Z",
    "dateUpdated": "2026-11-13T18:57:22.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-126196 (GCVE-0-2026-126196)

    Vulnerability from nvd – Published: 2026-11-12 17:27 – Updated: 2026-11-12 19:29
    VLAI
    Title
    pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0.
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-12 19:19 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command
    • CWE-693 - Protection Mechanism Failure
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126196",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T19:19:59.698501Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T19:29:05.237Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL\u0027s simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:27:28.595Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-j7mp-839j-jrm7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-j7mp-839j-jrm7"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-j7mp-839j-jrm7",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-126196",
    "datePublished": "2026-11-12T17:27:28.595Z",
    "dateReserved": "2026-11-10T20:07:44.957Z",
    "dateUpdated": "2026-11-12T19:29:05.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125322 (GCVE-0-2026-125322)

    Vulnerability from nvd – Published: 2026-11-10 17:39 – Updated: 2026-11-10 17:39
    VLAI
    Title
    pgEdge Postgres MCP Server SQL injection in the count_rows where parameter
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command
    • CWE-209 - Generation of Error Message Containing Sensitive Information
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role\u0027s existing SELECT privileges. This issue is fixed in version 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T17:39:00.060Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/200",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/200"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/201",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/201"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fhv3-x3jh-grj7",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server SQL injection in the count_rows where parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125322",
    "datePublished": "2026-11-10T17:39:00.060Z",
    "dateReserved": "2026-11-09T21:22:55.597Z",
    "dateUpdated": "2026-11-10T17:39:00.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125321 (GCVE-0-2026-125321)

    Vulnerability from nvd – Published: 2026-11-10 17:36 – Updated: 2026-11-10 21:07
    VLAI
    Title
    pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. ExtractIPAddress in internal/auth/middleware.go supplied that value to IsAllowed and RecordFailedAttempt in internal/auth/rate_limiter.go, allowing an unauthenticated caller to rotate addresses to evade throttling or assert another user's address to consume that user's limiter bucket. The published nginx configuration appended rather than replaced X-Forwarded-For, making the issue reachable without an operator misconfiguration. Username-keyed account lockout did not use the client address, but shipped defaults disabled that separate control through MaxFailedAttemptsBeforeLockout: 0. This issue is fixed in version 1.1.0.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-10 21:07 UTC
    CWE
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    • CWE-807 - Reliance on Untrusted Inputs in a Security Decision
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125321",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T21:07:03.759054Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:07:19.230Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. ExtractIPAddress in internal/auth/middleware.go supplied that value to IsAllowed and RecordFailedAttempt in internal/auth/rate_limiter.go, allowing an unauthenticated caller to rotate addresses to evade throttling or assert another user\u0027s address to consume that user\u0027s limiter bucket. The published nginx configuration appended rather than replaced X-Forwarded-For, making the issue reachable without an operator misconfiguration. Username-keyed account lockout did not use the client address, but shipped defaults disabled that separate control through MaxFailedAttemptsBeforeLockout: 0. This issue is fixed in version 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-807",
              "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T17:36:23.877Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v347-v3w7-7fq9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v347-v3w7-7fq9"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/204",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/204"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/205",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/205"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/6a19e46a240b9f4661a4a253811948dd75c4077e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/6a19e46a240b9f4661a4a253811948dd75c4077e"
        }
      ],
      "source": {
        "advisory": "GHSA-v347-v3w7-7fq9",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125321",
    "datePublished": "2026-11-10T17:36:23.877Z",
    "dateReserved": "2026-11-09T21:22:55.597Z",
    "dateUpdated": "2026-11-10T21:07:19.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125320 (GCVE-0-2026-125320)

    Vulnerability from nvd – Published: 2026-11-10 17:23 – Updated: 2026-11-13 15:31
    VLAI
    Title
    pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-13 15:31 UTC
    CWE
    • CWE-346 - Origin Validation Error
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125320",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T15:31:40.892443Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T15:31:58.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T17:23:43.734Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/231",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/231"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/232",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/232"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6hg5-9f3w-c886",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125320",
    "datePublished": "2026-11-10T17:23:43.734Z",
    "dateReserved": "2026-11-09T21:22:55.597Z",
    "dateUpdated": "2026-11-13T15:31:58.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-126199 (GCVE-0-2026-126199)

    Vulnerability from cvelistv5 – Published: 2026-11-12 17:32 – Updated: 2026-11-12 17:32
    VLAI
    Title
    pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query_database statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allow_writes connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
    CWE
    • CWE-357 - Insufficient UI Warning of Dangerous Operations
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query_database statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allow_writes connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-357",
              "description": "CWE-357: Insufficient UI Warning of Dangerous Operations",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:32:08.972Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-5gmh-9683-hhq9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-5gmh-9683-hhq9"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/233",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/233"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/310c02809891cfaee6e4891cd7bb9aa1d459575c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/310c02809891cfaee6e4891cd7bb9aa1d459575c"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5gmh-9683-hhq9",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-126199",
    "datePublished": "2026-11-12T17:32:08.972Z",
    "dateReserved": "2026-11-10T20:07:44.958Z",
    "dateUpdated": "2026-11-12T17:32:08.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-126198 (GCVE-0-2026-126198)

    Vulnerability from cvelistv5 – Published: 2026-11-12 17:31 – Updated: 2026-11-13 00:19
    VLAI
    Title
    pgEdge Postgres MCP Server custom tools performed writes without user confirmation
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0.
    Severity
    3.1 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-13 00:19 UTC
    CWE
    • CWE-357 - Insufficient UI Warning of Dangerous Operations
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126198",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T00:19:36.420416Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T00:19:49.261Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-357",
              "description": "CWE-357: Insufficient UI Warning of Dangerous Operations",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:31:01.420Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/198",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/198"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-v44x-hxg7-5cgc",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server custom tools performed writes without user confirmation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-126198",
    "datePublished": "2026-11-12T17:31:01.420Z",
    "dateReserved": "2026-11-10T20:07:44.957Z",
    "dateUpdated": "2026-11-13T00:19:49.261Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-126197 (GCVE-0-2026-126197)

    Vulnerability from cvelistv5 – Published: 2026-11-12 17:29 – Updated: 2026-11-13 18:57
    VLAI
    Title
    pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-13 18:57 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126197",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T18:57:00.288680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T18:57:22.759Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:29:35.883Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r5pp-jx86-r6r9",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-126197",
    "datePublished": "2026-11-12T17:29:35.883Z",
    "dateReserved": "2026-11-10T20:07:44.957Z",
    "dateUpdated": "2026-11-13T18:57:22.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-126196 (GCVE-0-2026-126196)

    Vulnerability from cvelistv5 – Published: 2026-11-12 17:27 – Updated: 2026-11-12 19:29
    VLAI
    Title
    pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0.
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-12 19:19 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command
    • CWE-693 - Protection Mechanism Failure
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126196",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T19:19:59.698501Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T19:29:05.237Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL\u0027s simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:27:28.595Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-j7mp-839j-jrm7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-j7mp-839j-jrm7"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-j7mp-839j-jrm7",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-126196",
    "datePublished": "2026-11-12T17:27:28.595Z",
    "dateReserved": "2026-11-10T20:07:44.957Z",
    "dateUpdated": "2026-11-12T19:29:05.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125322 (GCVE-0-2026-125322)

    Vulnerability from cvelistv5 – Published: 2026-11-10 17:39 – Updated: 2026-11-10 17:39
    VLAI
    Title
    pgEdge Postgres MCP Server SQL injection in the count_rows where parameter
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command
    • CWE-209 - Generation of Error Message Containing Sensitive Information
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role\u0027s existing SELECT privileges. This issue is fixed in version 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T17:39:00.060Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/200",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/200"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/201",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/201"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fhv3-x3jh-grj7",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server SQL injection in the count_rows where parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125322",
    "datePublished": "2026-11-10T17:39:00.060Z",
    "dateReserved": "2026-11-09T21:22:55.597Z",
    "dateUpdated": "2026-11-10T17:39:00.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125321 (GCVE-0-2026-125321)

    Vulnerability from cvelistv5 – Published: 2026-11-10 17:36 – Updated: 2026-11-10 21:07
    VLAI
    Title
    pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. ExtractIPAddress in internal/auth/middleware.go supplied that value to IsAllowed and RecordFailedAttempt in internal/auth/rate_limiter.go, allowing an unauthenticated caller to rotate addresses to evade throttling or assert another user's address to consume that user's limiter bucket. The published nginx configuration appended rather than replaced X-Forwarded-For, making the issue reachable without an operator misconfiguration. Username-keyed account lockout did not use the client address, but shipped defaults disabled that separate control through MaxFailedAttemptsBeforeLockout: 0. This issue is fixed in version 1.1.0.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-10 21:07 UTC
    CWE
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    • CWE-807 - Reliance on Untrusted Inputs in a Security Decision
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125321",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T21:07:03.759054Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:07:19.230Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. ExtractIPAddress in internal/auth/middleware.go supplied that value to IsAllowed and RecordFailedAttempt in internal/auth/rate_limiter.go, allowing an unauthenticated caller to rotate addresses to evade throttling or assert another user\u0027s address to consume that user\u0027s limiter bucket. The published nginx configuration appended rather than replaced X-Forwarded-For, making the issue reachable without an operator misconfiguration. Username-keyed account lockout did not use the client address, but shipped defaults disabled that separate control through MaxFailedAttemptsBeforeLockout: 0. This issue is fixed in version 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-807",
              "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T17:36:23.877Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v347-v3w7-7fq9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v347-v3w7-7fq9"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/204",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/204"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/205",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/205"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/6a19e46a240b9f4661a4a253811948dd75c4077e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/6a19e46a240b9f4661a4a253811948dd75c4077e"
        }
      ],
      "source": {
        "advisory": "GHSA-v347-v3w7-7fq9",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125321",
    "datePublished": "2026-11-10T17:36:23.877Z",
    "dateReserved": "2026-11-09T21:22:55.597Z",
    "dateUpdated": "2026-11-10T21:07:19.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125320 (GCVE-0-2026-125320)

    Vulnerability from cvelistv5 – Published: 2026-11-10 17:23 – Updated: 2026-11-13 15:31
    VLAI
    Title
    pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding
    Summary
    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-13 15:31 UTC
    CWE
    • CWE-346 - Origin Validation Error
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7843 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125320",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T15:31:40.892443Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T15:31:58.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgedge-postgres-mcp",
          "vendor": "pgEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T17:23:43.734Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/231",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/231"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/232",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/232"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e"
        },
        {
          "name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6hg5-9f3w-c886",
        "discovery": "UNKNOWN"
      },
      "title": "pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125320",
    "datePublished": "2026-11-10T17:23:43.734Z",
    "dateReserved": "2026-11-09T21:22:55.597Z",
    "dateUpdated": "2026-11-13T15:31:58.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}