CVE-2026-87911

CVE-2026-87911 is an OS command injection flaw (CWE-78) in the SQL validation component that enforces read-only mode in Amazon's awslabs postgres-mcp-server, where an incomplete statement filter (CWE-184) allows COPY ... TO PROGRAM statements to slip past the read-only check. An unauthenticated attacker places a crafted COPY ... TO PROGRAM statement into content processed by the server; when an authenticated user interacts with the MCP server in its default read-only mode, the self-managed PostgreSQL server executes the statement, running attacker-chosen operating system commands on the database host. The CVSS 4.0 score of 9 (critical) reflects high impact to confidentiality, integrity, and availability on both the vulnerable system and downstream systems, effectively amounting to remote command execution on the PostgreSQL host with the database process's privileges. Affected users are those running postgres-mcp-server before 1.1.7 against self-managed PostgreSQL servers that permit COPY ... TO PROGRAM; deployments against fully managed database services without program execution are not exposed to host-level command execution. No public proof-of-concept or confirmed in-the-wild exploitation is known, the issue is not in CISA KEV, and version 1.1.7 contains the fix.

What to do: Upgrade postgres-mcp-server to version 1.1.7 or later. Until patched, restrict the PostgreSQL role used by the server so it cannot execute server-side programs (e.g., lacks pg_execute_server_program), limit which content can be routed into MCP sessions, and review database hosts for unexpected command execution. Inventory deployments to confirm which instances run pre-1.1.7 versions, since exploitation requires an authenticated user session in default read-only mode to trigger.