---
id: "CVE-2026-125320"
page: "https://infrastack.ai/live/CVE-2026-125320"
kind: "vulnerability"
aliases: ["CVE-2026-125320"]
title: "pgEdge Postgres MCP Server: DNS rebinding lets web pages read database results"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "developer-workstation", "mcp", "pgedge", "postgresql"]
not_affected_if: ["stdio-transport", "version-1.1.0-or-later"]
published_at: "2026-11-10T18:17:33+00:00"
first_seen_at: "2026-11-10T18:22:55+00:00"
updated_at: "2026-11-10T18:26:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125320", "first_seen_at": "2026-11-10T18:22:55+00:00"}]
exploit_sources: []
---

# pgEdge Postgres MCP Server: DNS rebinding lets web pages read database results

Link for people: https://infrastack.ai/live/CVE-2026-125320 (this .md is for agents)

The pgEdge Postgres MCP Server, which lets AI clients run SQL against PostgreSQL, did not check the Origin header on its HTTP transport before version 1.1.0. A malicious web page visited in a browser on the same machine could use DNS rebinding to read database schemas and query results.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the pgEdge Postgres MCP Server version; affected if below `1.1.0`.
- Check whether the HTTP transport is enabled rather than the default stdio transport.
- Confirm the server is running on a machine where a browser is used.

## Fix

- pgEdge Postgres MCP Server: upgrade to `1.1.0`.

## Timeline

- 2026-11-10T18:22:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125320

## Documents

- [advisory] Vendor advisory: github.com https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886
- [fix] Patch: github.com https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e
- [fix] Release notes: github.com https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0

## From the sources

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_