CVE-2026-126196
Received Received - Intake

SQL Injection in pgEdge Postgres MCP Server

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-126196
EUVD
EUVD-2026-124566

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pgedge pgedge-postgres-mcp to 1.1.0 (exc)
pgedge pgedge-postgres-mcp 1.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in pgEdge Postgres MCP Server allows attackers to bypass read-only mode by smuggling SQL statements through the query_database tool. It enables unauthorized write operations like creating, altering, or dropping database objects even when the connection is configured as read-only. The issue stems from improper validation of transaction modes, insufficient detection of read-only queries, and the use of PostgreSQL's simple query protocol which permits multiple semicolon-separated statements in one request.

Detection Guidance

To detect this vulnerability, check the version of pgEdge Postgres MCP Server. If it is 1.0.0 or earlier, the system is vulnerable. Run: pgedge-postgres-mcp --version. Additionally, monitor logs for suspicious SQL statements containing multiple semicolon-separated commands or attempts to alter transaction modes.

Impact Analysis

This vulnerability can compromise data integrity and availability by allowing unauthorized write operations on a supposedly read-only database. Attackers could alter or delete data, create malicious database objects, or manipulate transaction states. The impact is higher in environments relying on read-only connections for safety, as pooled session states may retain write capabilities across multiple tool calls.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict data integrity and access controls, such as GDPR's data protection principles or HIPAA's security rules for protected health information. Unauthorized write operations may lead to data tampering or loss, which could result in regulatory penalties, loss of trust, and legal consequences for organizations failing to maintain proper access boundaries.

Mitigation Strategies

Upgrade pgEdge Postgres MCP Server to version 1.1.0 or later immediately. If upgrading is not possible, revoke write privileges from the connecting role as a temporary workaround. Ensure all read-only connections enforce strict statement validation and use the extended query protocol.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126196. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...