CVE-2026-125322 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Before version 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the one named in the call. A caller could use the returned row count as an inference oracle to extract data from any table the connected database role could already read.
first public Sep 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running the pgEdge Postgres MCP Server before 1.1.0 that let MCP clients or users call the count_rows tool. The flaw does not grant access beyond the database role's existing SELECT privileges, so exposure is limited to data that role can already read. Teams on 1.1.0 or later, or not running this MCP server, can skip it.
Not affected if no-mcp-server, version-1.1.0-or-later
Who cares mcp, pgedge, postgresql
1.1.0, it is affected.1.1.0.pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0.
This page as ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.