CVE-2026-126198
Received Received - Intake

pgEdge Postgres MCP Server Write Confirmation Bypass

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-126198
EUVD
EUVD-2026-124569

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pgedge pgedge_postgres_mcp 1.1.0
pgedge pgedge_postgres_mcp to 1.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-357 The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in pgEdge Postgres MCP Server (before version 1.1.0) allows custom SQL tools to execute write operations without user confirmation. The bundled CLI and web clients only checked for a specific tool name to decide if confirmation was needed, not server-published write annotations. Attackers could embed malicious instructions in retrieved content, tricking models into executing writes without prompts, especially when using custom tools with allow_writes connections.

Impact Analysis

If exploited, this vulnerability could allow unauthorized database writes, such as inserting malicious data or modifying existing records, without user awareness. Attackers might propagate poisoned documents across sessions, leading to data corruption or unauthorized changes. The impact depends on whether custom tools with write access are used and if retrieved content is trusted.

Mitigation Strategies

Upgrade pgEdge Postgres MCP Server to version 1.1.0 or later to address the write confirmation bypass issue. Review audit logs for unexpected write operations and ensure custom tools are properly annotated with MCP write capabilities. Consider using a role with no write privileges for connections where custom tools are not required to write.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...