{"id":"CVE-2026-125320","kind":"vulnerability","aliases":["CVE-2026-125320"],"related":[],"title":"pgEdge Postgres MCP Server: DNS rebinding lets web pages read database results","description":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0.","summary":"The pgEdge Postgres MCP Server, which lets AI clients run SQL against PostgreSQL, did not check the Origin header on its HTTP transport before version 1.1.0. A malicious web page visited in a browser on the same machine could use DNS rebinding to read database schemas and query results.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","developer-workstation","mcp","pgedge","postgresql"],"not_affected_if":["stdio-transport","version-1.1.0-or-later"],"how_to_check":"- Check the pgEdge Postgres MCP Server version; affected if below `1.1.0`.\n- Check whether the HTTP transport is enabled rather than the default stdio transport.\n- Confirm the server is running on a machine where a browser is used.","fix":"- pgEdge Postgres MCP Server: upgrade to `1.1.0`.","status":"open","published_at":"2026-11-10T18:17:33+00:00","first_seen_at":"2026-11-10T18:22:55+00:00","triaged_at":"2026-11-10T18:26:23+00:00","updated_at":"2026-11-10T18:26:23+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-10T18:26:23Z","model":"claude-haiku-5-5","output":{"fix":"- pgEdge Postgres MCP Server: upgrade to `1.1.0`.","reach":"local","title":"pgEdge Postgres MCP Server: DNS rebinding lets web pages read database results","impact":"medium","summary":"The pgEdge Postgres MCP Server, which lets AI clients run SQL against PostgreSQL, did not check the Origin header on its HTTP transport before version 1.1.0. A malicious web page visited in a browser on the same machine could use DNS rebinding to read database schemas and query results.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mcp","postgresql","pgedge","developer-workstation"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Web page reads database schemas and query results from the local server","analyst_note":"","how_to_check":"- Check the pgEdge Postgres MCP Server version; affected if below `1.1.0`.\n- Check whether the HTTP transport is enabled rather than the default stdio transport.\n- Confirm the server is running on a machine where a browser is used.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["stdio-transport","version-1.1.0-or-later"],"who_is_affected":"Teams running the pgEdge Postgres MCP Server with the HTTP transport enabled on a workstation or host that also runs a browser. The default stdio transport was not reachable through this path, so setups using only stdio can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000747,"input_tokens":4698,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125320':15A,18A '-2026':14A,17A '1.1.0':53B,95C,175C 'affect':143C 'ai':20B,35B 'ai-tool':19B 'allow':123C 'also':154C 'attack':114C 'attacker-control':113C 'browser':61B,157C 'check':43B 'client':36B,92C 'compat':91C 'configur':139C 'context':89C 'control':115C 'could':66B,117C 'cve':13A,16A 'databas':11A,72B,86C,140C 'default':160C 'deploy':144C 'develop':23B 'developer-workst':22B 'dns':5A,68B,121C 'enabl':81C,149C 'fix':172C 'header':46B,104C 'http':49B,97C,147C 'incom':106C 'issu':142C,170C 'let':7A,34B 'local':129C 'machin':65B,152C 'malici':55B 'mcp':3A,25B,31B,79C 'model':88C 'origin':45B,103C 'page':9A,57B,116C,125C 'path':168C 'pgedg':1A,26B,29B,77C 'postgr':2A,30B,78C 'postgresql':27B,40B,85C 'prior':93C 'protocol':90C 'queri':75B,83C,136C 'ran':155C 'reach':127C 'reachabl':165C 'read':10A,71B,133C 'rebind':6A,69B,122C 'request':107C 'result':12A,76B,137C 'run':37B,130C 'schema':73B,134C 'server':4A,32B,80C,131C 'sql':38B,82C 'stdio':161C 'target':119C 'tool':21B 'transport':50B,98C,148C,162C 'use':67B 'user':109C 'valid':101C 'version':52B,174C 'visit':58B,111C 'web':8A,56B 'workstat':24B","nicknames":[],"mitigations":[],"who_affected":"Teams running the pgEdge Postgres MCP Server with the HTTP transport enabled on a workstation or host that also runs a browser. The default stdio transport was not reachable through this path, so setups using only stdio can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","developerworkstation","mcp","medium","pgedge","postgresql"],"campaign_type":null,"search_a":"'-125320':15A,18A '-2026':14A,17A 'cve':13A,16A 'databas':11A 'dns':5A 'let':7A 'mcp':3A 'page':9A 'pgedg':1A 'postgr':2A 'read':10A 'rebind':6A 'result':12A 'server':4A 'web':8A","search_b":"'1.1.0':53B 'ai':20B,35B 'ai-tool':19B 'browser':61B 'check':43B 'client':36B 'could':66B 'databas':72B 'develop':23B 'developer-workst':22B 'dns':68B 'header':46B 'http':49B 'let':34B 'machin':65B 'malici':55B 'mcp':25B,31B 'origin':45B 'page':57B 'pgedg':26B,29B 'postgr':30B 'postgresql':27B,40B 'queri':75B 'read':71B 'rebind':69B 'result':76B 'run':37B 'schema':73B 'server':32B 'sql':38B 'tool':21B 'transport':50B 'use':67B 'version':52B 'visit':58B 'web':56B 'workstat':24B","search_c":"'1.1.0':95C,175C 'affect':143C 'allow':123C 'also':154C 'attack':114C 'attacker-control':113C 'browser':157C 'client':92C 'compat':91C 'configur':139C 'context':89C 'control':115C 'could':117C 'databas':86C,140C 'default':160C 'deploy':144C 'dns':121C 'enabl':81C,149C 'fix':172C 'header':104C 'http':97C,147C 'incom':106C 'issu':142C,170C 'local':129C 'machin':152C 'mcp':79C 'model':88C 'origin':103C 'page':116C,125C 'path':168C 'pgedg':77C 'postgr':78C 'postgresql':85C 'prior':93C 'protocol':90C 'queri':83C,136C 'ran':155C 'reach':127C 'reachabl':165C 'read':133C 'rebind':122C 'request':107C 'result':137C 'run':130C 'schema':134C 'server':80C,131C 'sql':82C 'stdio':161C 'target':119C 'transport':98C,148C,162C 'user':109C 'valid':101C 'version':174C 'visit':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-03T12:41:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125320","severity":null,"published_at":"2026-11-10T18:17:33+00:00","modified_at":"2026-11-10T18:17:33+00:00","first_seen_at":"2026-11-10T18:22:55+00:00","fetched_at":"2026-11-10T18:22:55+00:00","note":null}],"documents":[{"id":116897,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116898,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116899,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T12:41:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}