---
id: "CVE-2026-125322"
page: "https://infrastack.ai/live/CVE-2026-125322"
kind: "vulnerability"
aliases: ["CVE-2026-125322"]
title: "pgEdge Postgres MCP Server: count_rows lets callers infer data from other tables"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "mcp", "pgedge", "postgresql"]
not_affected_if: ["no-mcp-server", "version-1.1.0-or-later"]
published_at: "2026-11-10T18:17:33+00:00"
first_seen_at: "2026-11-10T18:22:56+00:00"
updated_at: "2026-11-10T18:24:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125322", "first_seen_at": "2026-11-10T18:22:56+00:00"}]
exploit_sources: []
---

# pgEdge Postgres MCP Server: count_rows lets callers infer data from other tables

Link for people: https://infrastack.ai/live/CVE-2026-125322 (this .md is for agents)

Before version 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the one named in the call. A caller could use the returned row count as an inference oracle to extract data from any table the connected database role could already read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed pgEdge Postgres MCP Server version; if it is below `1.1.0`, it is affected.
- Confirm whether the count_rows tool is exposed to MCP clients that callers can reach.

## Fix

- Upgrade pgEdge Postgres MCP Server to `1.1.0`.

## Timeline

- 2026-11-10T18:22:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125322

## Documents

- [advisory] Vendor advisory: github.com https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7
- [fix] Patch: github.com https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314
- [fix] Release notes: github.com https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0

## From the sources

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_