CVE-2026-85787

AWS Labs postgres-mcp-server before 1.1.7 contains an incomplete list of disallowed inputs (CWE-184) in its SQL validation component, so some write statements slip past the tool's read-only enforcement. An unauthenticated attacker can craft SQL embedded in content that is submitted when an authenticated user interacts with the MCP server, causing the crafted statements to execute against the connected PostgreSQL database (per CVSS 4.0, user interaction is required). The attacker gains the ability to modify data beyond the intended read-only scope (high integrity impact; no confidentiality or availability impact), without needing credentials. Any deployment running postgres-mcp-server prior to 1.1.7 is affected. There is no known exploitation, no public proof-of-concept, and EPSS puts 30-day exploitation probability at just 0.2%.

What to do: Upgrade postgres-mcp-server to version 1.1.7 or later. As interim mitigations, limit network exposure of the MCP server, run it with a database role that has tightly scoped privileges, and review database logs for unexpected writes on databases accessed through the server.