Search
Find a vulnerability
Search criteria
26 vulnerabilities by pgEdge
CVE-2026-126199 (GCVE-0-2026-126199)
Vulnerability from nvd – Published: 2026-11-12 17:32 – Updated: 2026-11-12 17:32
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query_database statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allow_writes connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0.
Severity
6.8 (Medium)
CWE
- CWE-357 - Insufficient UI Warning of Dangerous Operations
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/233 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query_database statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allow_writes connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-357",
"description": "CWE-357: Insufficient UI Warning of Dangerous Operations",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:32:08.972Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-5gmh-9683-hhq9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-5gmh-9683-hhq9"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/233",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/233"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/310c02809891cfaee6e4891cd7bb9aa1d459575c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/310c02809891cfaee6e4891cd7bb9aa1d459575c"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-5gmh-9683-hhq9",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-126199",
"datePublished": "2026-11-12T17:32:08.972Z",
"dateReserved": "2026-11-10T20:07:44.958Z",
"dateUpdated": "2026-11-12T17:32:08.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126198 (GCVE-0-2026-126198)
Vulnerability from nvd – Published: 2026-11-12 17:31 – Updated: 2026-11-13 00:19
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server custom tools performed writes without user confirmation
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:19 UTC
CWE
- CWE-357 - Insufficient UI Warning of Dangerous Operations
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/198 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:19:36.420416Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T00:19:49.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-357",
"description": "CWE-357: Insufficient UI Warning of Dangerous Operations",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:31:01.420Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/198",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/198"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-v44x-hxg7-5cgc",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server custom tools performed writes without user confirmation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-126198",
"datePublished": "2026-11-12T17:31:01.420Z",
"dateReserved": "2026-11-10T20:07:44.957Z",
"dateUpdated": "2026-11-13T00:19:49.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126197 (GCVE-0-2026-126197)
Vulnerability from nvd – Published: 2026-11-12 17:29 – Updated: 2026-11-12 17:29
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0.
Severity
8.8 (High)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/196 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:29:35.883Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-r5pp-jx86-r6r9",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-126197",
"datePublished": "2026-11-12T17:29:35.883Z",
"dateReserved": "2026-11-10T20:07:44.957Z",
"dateUpdated": "2026-11-12T17:29:35.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126196 (GCVE-0-2026-126196)
Vulnerability from nvd – Published: 2026-11-12 17:27 – Updated: 2026-11-12 19:29
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 19:19 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/196 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126196",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T19:19:59.698501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T19:29:05.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL\u0027s simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:27:28.595Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-j7mp-839j-jrm7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-j7mp-839j-jrm7"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-j7mp-839j-jrm7",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-126196",
"datePublished": "2026-11-12T17:27:28.595Z",
"dateReserved": "2026-11-10T20:07:44.957Z",
"dateUpdated": "2026-11-12T19:29:05.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125328 (GCVE-0-2026-125328)
Vulnerability from nvd – Published: 2026-11-10 18:05 – Updated: 2026-11-13 15:34
VLAI
EPSS
VEX
Title
pgEdge Go LLM Library discloses provider API key fragments in error messages
Summary
pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:33 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-go-llm-lib/secur… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-go-llm-lib/pull/26 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-go-llm-lib/commi… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-go-llm-lib/commi… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-go-llm-lib/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-go-llm-lib |
Affected:
>= 0.1.0, < 0.2.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:33:59.094273Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:34:20.583Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-go-llm-lib",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator\u0027s real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator\u0027s third-party provider API key from the resulting error. This issue is fixed in version 0.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:05:20.491Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-go-llm-lib/security/advisories/GHSA-8835-xmqj-354h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-go-llm-lib/security/advisories/GHSA-8835-xmqj-354h"
},
{
"name": "https://github.com/pgEdge/pgedge-go-llm-lib/pull/26",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-go-llm-lib/pull/26"
},
{
"name": "https://github.com/pgEdge/pgedge-go-llm-lib/commit/7531a55d368b3a29cd173c792cc4609c4134b076",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-go-llm-lib/commit/7531a55d368b3a29cd173c792cc4609c4134b076"
},
{
"name": "https://github.com/pgEdge/pgedge-go-llm-lib/commit/8bb9a6380d5f8db0124b51605759897034ad4da1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-go-llm-lib/commit/8bb9a6380d5f8db0124b51605759897034ad4da1"
},
{
"name": "https://github.com/pgEdge/pgedge-go-llm-lib/releases/tag/v0.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-go-llm-lib/releases/tag/v0.2.0"
}
],
"source": {
"advisory": "GHSA-8835-xmqj-354h",
"discovery": "UNKNOWN"
},
"title": "pgEdge Go LLM Library discloses provider API key fragments in error messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125328",
"datePublished": "2026-11-10T18:05:20.491Z",
"dateReserved": "2026-11-09T21:22:55.598Z",
"dateUpdated": "2026-11-13T15:34:20.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125327 (GCVE-0-2026-125327)
Vulnerability from nvd – Published: 2026-11-10 18:02 – Updated: 2026-11-12 18:02
VLAI
EPSS
VEX
Title
pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
Summary
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:37 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-rag-server/secur… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-rag-server/pull/44 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/commi… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-rag-server |
Affected:
< 2.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125327",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:37:53.452605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T18:02:40.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-rag-server",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-405",
"description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:02:58.722Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/pull/44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/pull/44"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"
}
],
"source": {
"advisory": "GHSA-5qg5-rgp6-j5m5",
"discovery": "UNKNOWN"
},
"title": "pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125327",
"datePublished": "2026-11-10T18:02:58.722Z",
"dateReserved": "2026-11-09T21:22:55.598Z",
"dateUpdated": "2026-11-12T18:02:40.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125326 (GCVE-0-2026-125326)
Vulnerability from nvd – Published: 2026-11-10 18:01 – Updated: 2026-11-10 20:59
VLAI
EPSS
VEX
Title
pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages
Summary
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 20:59 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-rag-server/secur… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-rag-server/pull/45 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/commi… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-rag-server |
Affected:
< 2.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125326",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T20:59:11.716195Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:59:21.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-rag-server",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator\u0027s credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:01:18.698Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/pull/45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/pull/45"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"
}
],
"source": {
"advisory": "GHSA-68g8-gh8f-7rhg",
"discovery": "UNKNOWN"
},
"title": "pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125326",
"datePublished": "2026-11-10T18:01:18.698Z",
"dateReserved": "2026-11-09T21:22:55.598Z",
"dateUpdated": "2026-11-10T20:59:21.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125325 (GCVE-0-2026-125325)
Vulnerability from nvd – Published: 2026-11-10 17:58 – Updated: 2026-11-13 15:33
VLAI
EPSS
VEX
Title
pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests
Summary
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:33 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-rag-server/secur… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-rag-server/pull/44 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/commi… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-rag-server |
Affected:
< 2.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125325",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:33:16.391558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:33:27.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-rag-server",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request\u0027s search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488: Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:58:40.428Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-w437-9mwm-j6vq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-w437-9mwm-j6vq"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/pull/44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/pull/44"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"
}
],
"source": {
"advisory": "GHSA-w437-9mwm-j6vq",
"discovery": "UNKNOWN"
},
"title": "pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125325",
"datePublished": "2026-11-10T17:58:40.428Z",
"dateReserved": "2026-11-09T21:22:55.597Z",
"dateUpdated": "2026-11-13T15:33:27.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125323 (GCVE-0-2026-125323)
Vulnerability from nvd – Published: 2026-11-10 17:52 – Updated: 2026-11-12 18:02
VLAI
EPSS
VEX
Title
pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections
Summary
pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:30 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/control-plane/security/… | x_refsource_CONFIRM |
| https://github.com/pgEdge/control-plane/pull/470 | x_refsource_MISC |
| https://github.com/pgEdge/control-plane/commit/88… | x_refsource_MISC |
| https://github.com/pgEdge/control-plane/blob/main… | x_refsource_MISC |
| https://github.com/pgEdge/control-plane/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | control-plane |
Affected:
< 0.11.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:30:56.164483Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T18:02:47.992Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "control-plane",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host\u0027s databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Functionality",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188: Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:52:28.455Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25"
},
{
"name": "https://github.com/pgEdge/control-plane/pull/470",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/control-plane/pull/470"
},
{
"name": "https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7"
},
{
"name": "https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md"
},
{
"name": "https://github.com/pgEdge/control-plane/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/control-plane/releases/tag/v0.11.0"
}
],
"source": {
"advisory": "GHSA-vq9p-w6wv-cr25",
"discovery": "UNKNOWN"
},
"title": "pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125323",
"datePublished": "2026-11-10T17:52:28.455Z",
"dateReserved": "2026-11-09T21:22:55.597Z",
"dateUpdated": "2026-11-12T18:02:47.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125322 (GCVE-0-2026-125322)
Vulnerability from nvd – Published: 2026-11-10 17:39 – Updated: 2026-11-10 17:39
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server SQL injection in the count_rows where parameter
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0.
Severity
6.5 (Medium)
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/iss… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/201 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role\u0027s existing SELECT privileges. This issue is fixed in version 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:39:00.060Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/200",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/200"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/201",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/201"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-fhv3-x3jh-grj7",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server SQL injection in the count_rows where parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125322",
"datePublished": "2026-11-10T17:39:00.060Z",
"dateReserved": "2026-11-09T21:22:55.597Z",
"dateUpdated": "2026-11-10T17:39:00.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125321 (GCVE-0-2026-125321)
Vulnerability from nvd – Published: 2026-11-10 17:36 – Updated: 2026-11-10 21:07
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. ExtractIPAddress in internal/auth/middleware.go supplied that value to IsAllowed and RecordFailedAttempt in internal/auth/rate_limiter.go, allowing an unauthenticated caller to rotate addresses to evade throttling or assert another user's address to consume that user's limiter bucket. The published nginx configuration appended rather than replaced X-Forwarded-For, making the issue reachable without an operator misconfiguration. Username-keyed account lockout did not use the client address, but shipped defaults disabled that separate control through MaxFailedAttemptsBeforeLockout: 0. This issue is fixed in version 1.1.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 21:07 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/iss… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/205 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T21:07:03.759054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T21:07:19.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. ExtractIPAddress in internal/auth/middleware.go supplied that value to IsAllowed and RecordFailedAttempt in internal/auth/rate_limiter.go, allowing an unauthenticated caller to rotate addresses to evade throttling or assert another user\u0027s address to consume that user\u0027s limiter bucket. The published nginx configuration appended rather than replaced X-Forwarded-For, making the issue reachable without an operator misconfiguration. Username-keyed account lockout did not use the client address, but shipped defaults disabled that separate control through MaxFailedAttemptsBeforeLockout: 0. This issue is fixed in version 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:36:23.877Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v347-v3w7-7fq9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v347-v3w7-7fq9"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/204",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/204"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/205",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/205"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/6a19e46a240b9f4661a4a253811948dd75c4077e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/6a19e46a240b9f4661a4a253811948dd75c4077e"
}
],
"source": {
"advisory": "GHSA-v347-v3w7-7fq9",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125321",
"datePublished": "2026-11-10T17:36:23.877Z",
"dateReserved": "2026-11-09T21:22:55.597Z",
"dateUpdated": "2026-11-10T21:07:19.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125320 (GCVE-0-2026-125320)
Vulnerability from nvd – Published: 2026-11-10 17:23 – Updated: 2026-11-13 15:31
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:31 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/iss… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/232 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125320",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:31:40.892443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:31:58.504Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:23:43.734Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/231",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/231"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/232",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/232"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-6hg5-9f3w-c886",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125320",
"datePublished": "2026-11-10T17:23:43.734Z",
"dateReserved": "2026-11-09T21:22:55.597Z",
"dateUpdated": "2026-11-13T15:31:58.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50735 (GCVE-0-2026-50735)
Vulnerability from nvd – Published: 2026-07-28 17:55 – Updated: 2026-11-12 19:08
VLAI
EPSS
VEX
Summary
pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 18:58 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.enterprisedb.com/docs/security/adviso… | |
| https://github.com/pgEdge/spock/security/advisori… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| EnterpriseDB | pglogical |
Affected:
2 , < 2.4.8
(semver)
|
|
| pgEdge | Spock |
Affected:
3 , ≤ 3.3.6
(custom)
Unaffected: 3.3.7 (custom) Affected: 4 , ≤ 4.1.0.3 (custom) Unaffected: 4.1.1 (custom) Affected: 5 , ≤ 5.0.11 (custom) Unaffected: 5.0.12 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50735",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T18:58:57.167071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T19:02:17.182Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "pglogical",
"vendor": "EnterpriseDB",
"versions": [
{
"lessThan": "2.4.8",
"status": "affected",
"version": "2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spock",
"repo": "https://github.com/pgEdge/spock",
"vendor": "pgEdge",
"versions": [
{
"lessThanOrEqual": "3.3.6",
"status": "affected",
"version": "3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.3.7",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.1.0.3",
"status": "affected",
"version": "4",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "4.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.0.11",
"status": "affected",
"version": "5",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "5.0.12",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mehmet Ince (@mdisec)"
}
],
"descriptions": [
{
"lang": "en",
"value": "pglogical\u0027s apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber\u0027s apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T19:08:46.842Z",
"orgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659",
"shortName": "EDB"
},
"references": [
{
"url": "https://www.enterprisedb.com/docs/security/advisories/cve202650735/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pgEdge/spock/security/advisories/GHSA-j2m3-f88h-2h46"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659",
"assignerShortName": "EDB",
"cveId": "CVE-2026-50735",
"datePublished": "2026-07-28T17:55:12.049Z",
"dateReserved": "2026-06-05T19:13:51.103Z",
"dateUpdated": "2026-11-12T19:08:46.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126199 (GCVE-0-2026-126199)
Vulnerability from cvelistv5 – Published: 2026-11-12 17:32 – Updated: 2026-11-12 17:32
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query_database statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allow_writes connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0.
Severity
6.8 (Medium)
CWE
- CWE-357 - Insufficient UI Warning of Dangerous Operations
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/233 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query_database statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allow_writes connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-357",
"description": "CWE-357: Insufficient UI Warning of Dangerous Operations",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:32:08.972Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-5gmh-9683-hhq9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-5gmh-9683-hhq9"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/233",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/233"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/310c02809891cfaee6e4891cd7bb9aa1d459575c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/310c02809891cfaee6e4891cd7bb9aa1d459575c"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-5gmh-9683-hhq9",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-126199",
"datePublished": "2026-11-12T17:32:08.972Z",
"dateReserved": "2026-11-10T20:07:44.958Z",
"dateUpdated": "2026-11-12T17:32:08.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126198 (GCVE-0-2026-126198)
Vulnerability from cvelistv5 – Published: 2026-11-12 17:31 – Updated: 2026-11-13 00:19
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server custom tools performed writes without user confirmation
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:19 UTC
CWE
- CWE-357 - Insufficient UI Warning of Dangerous Operations
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/198 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:19:36.420416Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T00:19:49.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-357",
"description": "CWE-357: Insufficient UI Warning of Dangerous Operations",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:31:01.420Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/198",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/198"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-v44x-hxg7-5cgc",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server custom tools performed writes without user confirmation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-126198",
"datePublished": "2026-11-12T17:31:01.420Z",
"dateReserved": "2026-11-10T20:07:44.957Z",
"dateUpdated": "2026-11-13T00:19:49.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126197 (GCVE-0-2026-126197)
Vulnerability from cvelistv5 – Published: 2026-11-12 17:29 – Updated: 2026-11-12 17:29
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0.
Severity
8.8 (High)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/196 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:29:35.883Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-r5pp-jx86-r6r9",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-126197",
"datePublished": "2026-11-12T17:29:35.883Z",
"dateReserved": "2026-11-10T20:07:44.957Z",
"dateUpdated": "2026-11-12T17:29:35.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126196 (GCVE-0-2026-126196)
Vulnerability from cvelistv5 – Published: 2026-11-12 17:27 – Updated: 2026-11-12 19:29
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 19:19 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/196 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126196",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T19:19:59.698501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T19:29:05.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL\u0027s simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:27:28.595Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-j7mp-839j-jrm7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-j7mp-839j-jrm7"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-j7mp-839j-jrm7",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-126196",
"datePublished": "2026-11-12T17:27:28.595Z",
"dateReserved": "2026-11-10T20:07:44.957Z",
"dateUpdated": "2026-11-12T19:29:05.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125328 (GCVE-0-2026-125328)
Vulnerability from cvelistv5 – Published: 2026-11-10 18:05 – Updated: 2026-11-13 15:34
VLAI
EPSS
VEX
Title
pgEdge Go LLM Library discloses provider API key fragments in error messages
Summary
pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:33 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-go-llm-lib/secur… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-go-llm-lib/pull/26 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-go-llm-lib/commi… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-go-llm-lib/commi… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-go-llm-lib/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-go-llm-lib |
Affected:
>= 0.1.0, < 0.2.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:33:59.094273Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:34:20.583Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-go-llm-lib",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator\u0027s real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator\u0027s third-party provider API key from the resulting error. This issue is fixed in version 0.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:05:20.491Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-go-llm-lib/security/advisories/GHSA-8835-xmqj-354h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-go-llm-lib/security/advisories/GHSA-8835-xmqj-354h"
},
{
"name": "https://github.com/pgEdge/pgedge-go-llm-lib/pull/26",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-go-llm-lib/pull/26"
},
{
"name": "https://github.com/pgEdge/pgedge-go-llm-lib/commit/7531a55d368b3a29cd173c792cc4609c4134b076",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-go-llm-lib/commit/7531a55d368b3a29cd173c792cc4609c4134b076"
},
{
"name": "https://github.com/pgEdge/pgedge-go-llm-lib/commit/8bb9a6380d5f8db0124b51605759897034ad4da1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-go-llm-lib/commit/8bb9a6380d5f8db0124b51605759897034ad4da1"
},
{
"name": "https://github.com/pgEdge/pgedge-go-llm-lib/releases/tag/v0.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-go-llm-lib/releases/tag/v0.2.0"
}
],
"source": {
"advisory": "GHSA-8835-xmqj-354h",
"discovery": "UNKNOWN"
},
"title": "pgEdge Go LLM Library discloses provider API key fragments in error messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125328",
"datePublished": "2026-11-10T18:05:20.491Z",
"dateReserved": "2026-11-09T21:22:55.598Z",
"dateUpdated": "2026-11-13T15:34:20.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125327 (GCVE-0-2026-125327)
Vulnerability from cvelistv5 – Published: 2026-11-10 18:02 – Updated: 2026-11-12 18:02
VLAI
EPSS
VEX
Title
pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
Summary
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:37 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-rag-server/secur… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-rag-server/pull/44 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/commi… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-rag-server |
Affected:
< 2.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125327",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:37:53.452605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T18:02:40.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-rag-server",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-405",
"description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:02:58.722Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/pull/44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/pull/44"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"
}
],
"source": {
"advisory": "GHSA-5qg5-rgp6-j5m5",
"discovery": "UNKNOWN"
},
"title": "pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125327",
"datePublished": "2026-11-10T18:02:58.722Z",
"dateReserved": "2026-11-09T21:22:55.598Z",
"dateUpdated": "2026-11-12T18:02:40.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125326 (GCVE-0-2026-125326)
Vulnerability from cvelistv5 – Published: 2026-11-10 18:01 – Updated: 2026-11-10 20:59
VLAI
EPSS
VEX
Title
pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages
Summary
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator's credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 20:59 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-rag-server/secur… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-rag-server/pull/45 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/commi… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-rag-server |
Affected:
< 2.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125326",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T20:59:11.716195Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:59:21.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-rag-server",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-controlled error text that can quote a partially masked submitted API key. A remote caller can cause an authentication failure and obtain part of the operator\u0027s credential for the third-party provider account through the query API error response. This issue is fixed in version 2.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:01:18.698Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/pull/45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/pull/45"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"
}
],
"source": {
"advisory": "GHSA-68g8-gh8f-7rhg",
"discovery": "UNKNOWN"
},
"title": "pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125326",
"datePublished": "2026-11-10T18:01:18.698Z",
"dateReserved": "2026-11-09T21:22:55.598Z",
"dateUpdated": "2026-11-10T20:59:21.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125325 (GCVE-0-2026-125325)
Vulnerability from cvelistv5 – Published: 2026-11-10 17:58 – Updated: 2026-11-13 15:33
VLAI
EPSS
VEX
Title
pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests
Summary
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:33 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-rag-server/secur… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-rag-server/pull/44 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/commi… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-rag-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-rag-server |
Affected:
< 2.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125325",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:33:16.391558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:33:27.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-rag-server",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request\u0027s search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488: Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:58:40.428Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-w437-9mwm-j6vq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-w437-9mwm-j6vq"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/pull/44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/pull/44"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"
},
{
"name": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"
}
],
"source": {
"advisory": "GHSA-w437-9mwm-j6vq",
"discovery": "UNKNOWN"
},
"title": "pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125325",
"datePublished": "2026-11-10T17:58:40.428Z",
"dateReserved": "2026-11-09T21:22:55.597Z",
"dateUpdated": "2026-11-13T15:33:27.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125323 (GCVE-0-2026-125323)
Vulnerability from cvelistv5 – Published: 2026-11-10 17:52 – Updated: 2026-11-12 18:02
VLAI
EPSS
VEX
Title
pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections
Summary
pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:30 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/control-plane/security/… | x_refsource_CONFIRM |
| https://github.com/pgEdge/control-plane/pull/470 | x_refsource_MISC |
| https://github.com/pgEdge/control-plane/commit/88… | x_refsource_MISC |
| https://github.com/pgEdge/control-plane/blob/main… | x_refsource_MISC |
| https://github.com/pgEdge/control-plane/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | control-plane |
Affected:
< 0.11.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:30:56.164483Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T18:02:47.992Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "control-plane",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host\u0027s databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Functionality",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188: Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:52:28.455Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25"
},
{
"name": "https://github.com/pgEdge/control-plane/pull/470",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/control-plane/pull/470"
},
{
"name": "https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7"
},
{
"name": "https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md"
},
{
"name": "https://github.com/pgEdge/control-plane/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/control-plane/releases/tag/v0.11.0"
}
],
"source": {
"advisory": "GHSA-vq9p-w6wv-cr25",
"discovery": "UNKNOWN"
},
"title": "pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125323",
"datePublished": "2026-11-10T17:52:28.455Z",
"dateReserved": "2026-11-09T21:22:55.597Z",
"dateUpdated": "2026-11-12T18:02:47.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125322 (GCVE-0-2026-125322)
Vulnerability from cvelistv5 – Published: 2026-11-10 17:39 – Updated: 2026-11-10 17:39
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server SQL injection in the count_rows where parameter
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0.
Severity
6.5 (Medium)
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/iss… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/201 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role\u0027s existing SELECT privileges. This issue is fixed in version 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:39:00.060Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/200",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/200"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/201",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/201"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-fhv3-x3jh-grj7",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server SQL injection in the count_rows where parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125322",
"datePublished": "2026-11-10T17:39:00.060Z",
"dateReserved": "2026-11-09T21:22:55.597Z",
"dateUpdated": "2026-11-10T17:39:00.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125321 (GCVE-0-2026-125321)
Vulnerability from cvelistv5 – Published: 2026-11-10 17:36 – Updated: 2026-11-10 21:07
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. ExtractIPAddress in internal/auth/middleware.go supplied that value to IsAllowed and RecordFailedAttempt in internal/auth/rate_limiter.go, allowing an unauthenticated caller to rotate addresses to evade throttling or assert another user's address to consume that user's limiter bucket. The published nginx configuration appended rather than replaced X-Forwarded-For, making the issue reachable without an operator misconfiguration. Username-keyed account lockout did not use the client address, but shipped defaults disabled that separate control through MaxFailedAttemptsBeforeLockout: 0. This issue is fixed in version 1.1.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 21:07 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/iss… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/205 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T21:07:03.759054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T21:07:19.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. ExtractIPAddress in internal/auth/middleware.go supplied that value to IsAllowed and RecordFailedAttempt in internal/auth/rate_limiter.go, allowing an unauthenticated caller to rotate addresses to evade throttling or assert another user\u0027s address to consume that user\u0027s limiter bucket. The published nginx configuration appended rather than replaced X-Forwarded-For, making the issue reachable without an operator misconfiguration. Username-keyed account lockout did not use the client address, but shipped defaults disabled that separate control through MaxFailedAttemptsBeforeLockout: 0. This issue is fixed in version 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:36:23.877Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v347-v3w7-7fq9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v347-v3w7-7fq9"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/204",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/204"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/205",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/205"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/6a19e46a240b9f4661a4a253811948dd75c4077e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/6a19e46a240b9f4661a4a253811948dd75c4077e"
}
],
"source": {
"advisory": "GHSA-v347-v3w7-7fq9",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125321",
"datePublished": "2026-11-10T17:36:23.877Z",
"dateReserved": "2026-11-09T21:22:55.597Z",
"dateUpdated": "2026-11-10T21:07:19.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125320 (GCVE-0-2026-125320)
Vulnerability from cvelistv5 – Published: 2026-11-10 17:23 – Updated: 2026-11-13 15:31
VLAI
EPSS
VEX
Title
pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding
Summary
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:31 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/pgEdge/pgedge-postgres-mcp/sec… | x_refsource_CONFIRM |
| https://github.com/pgEdge/pgedge-postgres-mcp/iss… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/pull/232 | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/com… | x_refsource_MISC |
| https://github.com/pgEdge/pgedge-postgres-mcp/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgEdge | pgedge-postgres-mcp |
Affected:
< 1.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125320",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:31:40.892443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:31:58.504Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pgedge-postgres-mcp",
"vendor": "pgEdge",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:23:43.734Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/231",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/231"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/232",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/232"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"source": {
"advisory": "GHSA-6hg5-9f3w-c886",
"discovery": "UNKNOWN"
},
"title": "pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125320",
"datePublished": "2026-11-10T17:23:43.734Z",
"dateReserved": "2026-11-09T21:22:55.597Z",
"dateUpdated": "2026-11-13T15:31:58.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50735 (GCVE-0-2026-50735)
Vulnerability from cvelistv5 – Published: 2026-07-28 17:55 – Updated: 2026-11-12 19:08
VLAI
EPSS
VEX
Summary
pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 18:58 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.enterprisedb.com/docs/security/adviso… | |
| https://github.com/pgEdge/spock/security/advisori… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| EnterpriseDB | pglogical |
Affected:
2 , < 2.4.8
(semver)
|
|
| pgEdge | Spock |
Affected:
3 , ≤ 3.3.6
(custom)
Unaffected: 3.3.7 (custom) Affected: 4 , ≤ 4.1.0.3 (custom) Unaffected: 4.1.1 (custom) Affected: 5 , ≤ 5.0.11 (custom) Unaffected: 5.0.12 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50735",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T18:58:57.167071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T19:02:17.182Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "pglogical",
"vendor": "EnterpriseDB",
"versions": [
{
"lessThan": "2.4.8",
"status": "affected",
"version": "2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spock",
"repo": "https://github.com/pgEdge/spock",
"vendor": "pgEdge",
"versions": [
{
"lessThanOrEqual": "3.3.6",
"status": "affected",
"version": "3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "3.3.7",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.1.0.3",
"status": "affected",
"version": "4",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "4.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.0.11",
"status": "affected",
"version": "5",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "5.0.12",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mehmet Ince (@mdisec)"
}
],
"descriptions": [
{
"lang": "en",
"value": "pglogical\u0027s apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber\u0027s apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T19:08:46.842Z",
"orgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659",
"shortName": "EDB"
},
"references": [
{
"url": "https://www.enterprisedb.com/docs/security/advisories/cve202650735/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pgEdge/spock/security/advisories/GHSA-j2m3-f88h-2h46"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659",
"assignerShortName": "EDB",
"cveId": "CVE-2026-50735",
"datePublished": "2026-07-28T17:55:12.049Z",
"dateReserved": "2026-06-05T19:13:51.103Z",
"dateUpdated": "2026-11-12T19:08:46.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}