{"id":"CVE-2026-125322","kind":"vulnerability","aliases":["CVE-2026-125322"],"related":[],"title":"pgEdge Postgres MCP Server: count_rows lets callers infer data from other tables","description":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0.","summary":"Before version 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the one named in the call. A caller could use the returned row count as an inference oracle to extract data from any table the connected database role could already read.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","pgedge","postgresql"],"not_affected_if":["no-mcp-server","version-1.1.0-or-later"],"how_to_check":"- Check the installed pgEdge Postgres MCP Server version; if it is below `1.1.0`, it is affected.\n- Confirm whether the count_rows tool is exposed to MCP clients that callers can reach.","fix":"- Upgrade pgEdge Postgres MCP Server to `1.1.0`.","status":"open","published_at":"2026-11-10T18:17:33+00:00","first_seen_at":"2026-11-10T18:22:56+00:00","triaged_at":"2026-11-10T18:24:53+00:00","updated_at":"2026-11-10T18:24:53+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-10T18:24:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pgEdge Postgres MCP Server to `1.1.0`.","reach":"network","title":"pgEdge Postgres MCP Server: count_rows lets callers infer data from other tables","impact":"medium","summary":"Before version 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the one named in the call. A caller could use the returned row count as an inference oracle to extract data from any table the connected database role could already read.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp","postgresql","pgedge"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"caller reads data from any table the database role can select","analyst_note":"","how_to_check":"- Check the installed pgEdge Postgres MCP Server version; if it is below `1.1.0`, it is affected.\n- Confirm whether the count_rows tool is exposed to MCP clients that callers can reach.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.1.0-or-later","no-mcp-server"],"who_is_affected":"Teams running the pgEdge Postgres MCP Server before 1.1.0 that let MCP clients or users call the count_rows tool. The flaw does not grant access beyond the database role's existing SELECT privileges, so exposure is limited to data that role can already read. Teams on 1.1.0 or later, or not running this MCP server, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4685,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125322':16A,19A '-2026':15A,18A '1.1.0':28B,92C,170C 'accept':37B,101C 'access':154C 'ai':21B 'ai-tool':20B 'alreadi':72B 'boundari':145C 'call':48B,113C 'caller':8A,50B,115C 'client':89C 'compat':88C 'connect':68B,137C 'context':86C 'could':51B,71B,116C,140C 'count':5A,34B,56B,98C,123C 'cve':14A,17A 'data':10A,63B,130C 'databas':69B,83C,138C,143C 'enabl':78C 'exist':161C 'extract':62B,129C 'fix':167C 'flaw':150C 'grant':153C 'infer':9A,59B,126C 'intact':147C 'issu':165C 'let':7A 'mcp':3A,23B,76C 'model':85C 'name':45B,109C 'one':44B 'oracl':60B,127C 'outsid':157C 'paramet':31B,95C 'pgedg':1A,24B,74C 'postgr':2A,75C 'postgresql':25B,82C 'predic':118C 'prior':90C 'privileg':144C,163C 'protocol':87C 'queri':80C 'read':73B,141C 'remain':146C 'return':54B,121C 'role':70B,139C,159C 'row':6A,35B,55B,99C,122C 'select':162C 'server':4A,77C 'sql':79C 'subqueri':38B,102C 'tabl':13A,40B,66B,104C,108C,134C,156C 'tool':22B,36B,100C,112C 'use':52B,117C 'version':27B,169C","nicknames":[],"mitigations":[],"who_affected":"Teams running the pgEdge Postgres MCP Server before 1.1.0 that let MCP clients or users call the count_rows tool. The flaw does not grant access beyond the database role's existing SELECT privileges, so exposure is limited to data that role can already read. Teams on 1.1.0 or later, or not running this MCP server, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","mcp","medium","pgedge","postgresql"],"campaign_type":null,"search_a":"'-125322':16A,19A '-2026':15A,18A 'caller':8A 'count':5A 'cve':14A,17A 'data':10A 'infer':9A 'let':7A 'mcp':3A 'pgedg':1A 'postgr':2A 'row':6A 'server':4A 'tabl':13A","search_b":"'1.1.0':28B 'accept':37B 'ai':21B 'ai-tool':20B 'alreadi':72B 'call':48B 'caller':50B 'connect':68B 'could':51B,71B 'count':34B,56B 'data':63B 'databas':69B 'extract':62B 'infer':59B 'mcp':23B 'name':45B 'one':44B 'oracl':60B 'paramet':31B 'pgedg':24B 'postgresql':25B 'read':73B 'return':54B 'role':70B 'row':35B,55B 'subqueri':38B 'tabl':40B,66B 'tool':22B,36B 'use':52B 'version':27B","search_c":"'1.1.0':92C,170C 'accept':101C 'access':154C 'boundari':145C 'call':113C 'caller':115C 'client':89C 'compat':88C 'connect':137C 'context':86C 'could':116C,140C 'count':98C,123C 'data':130C 'databas':83C,138C,143C 'enabl':78C 'exist':161C 'extract':129C 'fix':167C 'flaw':150C 'grant':153C 'infer':126C 'intact':147C 'issu':165C 'mcp':76C 'model':85C 'name':109C 'oracl':127C 'outsid':157C 'paramet':95C 'pgedg':74C 'postgr':75C 'postgresql':82C 'predic':118C 'prior':90C 'privileg':144C,163C 'protocol':87C 'queri':80C 'read':141C 'remain':146C 'return':121C 'role':139C,159C 'row':99C,122C 'select':162C 'server':77C 'sql':79C 'subqueri':102C 'tabl':104C,108C,134C,156C 'tool':100C,112C 'use':117C 'version':169C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-03T12:42:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125322","severity":null,"published_at":"2026-11-10T18:17:33+00:00","modified_at":"2026-11-10T18:17:33+00:00","first_seen_at":"2026-11-10T18:22:56+00:00","fetched_at":"2026-11-10T18:22:56+00:00","note":null}],"documents":[{"id":116902,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116898,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116904,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T12:42:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}