{"id":"CVE-2026-126197","kind":"vulnerability","aliases":["CVE-2026-126197"],"related":[],"title":"pgEdge Postgres MCP Server: crafted tool arguments inject SQL into the database","description":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0.","summary":"The pgEdge Postgres MCP Server lets MCP clients run SQL against PostgreSQL. Before 1.1.0, custom pl-do tools placed JSON arguments into a DO block with fixed dollar-quote tags, so a crafted argument can break out and run extra SQL, including transaction control that bypasses read_only, with the privileges of the connecting database role.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","pgedge","postgresql"],"not_affected_if":["no-pl-do-tools","sql-or-pl-func-tools-only","version-1.1.0-or-later"],"how_to_check":"- Check whether any custom tool in the server configuration uses the `pl-do` type; only those are affected.\n- Check the server version; versions below `1.1.0` are affected.","fix":"- pgEdge Postgres MCP Server: upgrade to `1.1.0`.","status":"open","published_at":"2026-11-12T18:17:24+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","triaged_at":"2026-11-12T18:42:36+00:00","updated_at":"2026-11-12T18:42:36+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-12T18:42:36Z","model":"claude-haiku-5-5","output":{"fix":"- pgEdge Postgres MCP Server: upgrade to `1.1.0`.","reach":"network","title":"pgEdge Postgres MCP Server: crafted tool arguments inject SQL into the database","impact":"high","summary":"The pgEdge Postgres MCP Server lets MCP clients run SQL against PostgreSQL. Before 1.1.0, custom pl-do tools placed JSON arguments into a DO block with fixed dollar-quote tags, so a crafted argument can break out and run extra SQL, including transaction control that bypasses read_only, with the privileges of the connecting database role.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp","postgresql","pgedge"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary SQL with the database role's privileges.","analyst_note":"Attack prerequisites for needs_auth are not stated in the sources; the NVD entry does not give a required privilege level.","how_to_check":"- Check whether any custom tool in the server configuration uses the `pl-do` type; only those are affected.\n- Check the server version; versions below `1.1.0` are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-pl-do-tools","sql-or-pl-func-tools-only","version-1.1.0-or-later"],"who_is_affected":"Only deployments running the pgEdge Postgres MCP Server before 1.1.0 with at least one custom pl-do tool are exposed. Servers that use only sql or pl-func tools, which pass arguments as bind parameters, are not affected by this injection path. Teams can skip it if they have no pl-do custom tools or already run 1.1.0 or later.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000805,"input_tokens":4784,"output_tokens":653,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126197':15A,18A '-2026':14A,17A '1.1.0':38B,101C,214C 'access':169C 'addit':160C 'affect':204C 'ai':20B 'ai-tool':19B 'arbitrari':134C 'arg':139C 'argument':7A,46B,60B,109C,123C,197C 'avail':174C 'bind':199C 'block':50B,114C,131C,147C 'break':62B 'bypass':72B,165C 'client':32B,98C 'code':143C 'compat':97C 'connect':80B,177C 'contain':124C 'context':95C 'control':70B,164C 'could':128C,140C,158C 'craft':5A,59B 'custom':39B,102C,126C,188C 'cve':13A,16A 'data':170C 'databas':12A,81B,92C 'delimit':115C 'dollar':54B,119C 'dollar-quot':53B,118C 'enabl':87C 'extra':66B 'fix':52B,117C,212C 'func':194C 'includ':68B,159C 'inject':8A,133C,141C,156C,207C 'interpol':107C 'issu':180C,210C 'json':45B,108C 'least':183C 'let':30B 'mcp':3A,22B,28B,31B,85C,125C,138C 'mechan':208C 'model':94C 'modifi':172C 'one':184C 'paramet':200C 'pass':196C 'pgedg':1A,23B,26B,83C 'pl':41B,104C,186C,193C 'pl-do':40B,103C,185C 'pl-func':192C 'place':44B 'plpgsql':146C 'postgr':2A,27B,84C 'postgresql':24B,36B,91C,112C 'prior':99C 'privileg':77B 'procedur':142C 'protocol':96C,155C 'queri':89C,154C 'quot':55B,120C 'read':73B,166C 'requir':181C 'resourc':173C 'role':82B,178C 'run':33B,65B 'server':4A,29B,86C 'simpl':153C 'sql':9A,34B,67B,88C,135C,190C 'statement':136C,150C,161C 'tag':56B,121C 'termin':129C 'text':157C 'tool':6A,21B,43B,106C,127C,189C,195C 'transact':69B,163C 'use':151C","nicknames":[],"mitigations":[],"who_affected":"Only deployments running the pgEdge Postgres MCP Server before 1.1.0 with at least one custom pl-do tool are exposed. Servers that use only sql or pl-func tools, which pass arguments as bind parameters, are not affected by this injection path. Teams can skip it if they have no pl-do custom tools or already run 1.1.0 or later.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","mcp","pgedge","postgresql"],"campaign_type":null,"search_a":"'-126197':15A,18A '-2026':14A,17A 'argument':7A 'craft':5A 'cve':13A,16A 'databas':12A 'inject':8A 'mcp':3A 'pgedg':1A 'postgr':2A 'server':4A 'sql':9A 'tool':6A","search_b":"'1.1.0':38B 'ai':20B 'ai-tool':19B 'argument':46B,60B 'block':50B 'break':62B 'bypass':72B 'client':32B 'connect':80B 'control':70B 'craft':59B 'custom':39B 'databas':81B 'dollar':54B 'dollar-quot':53B 'extra':66B 'fix':52B 'includ':68B 'json':45B 'let':30B 'mcp':22B,28B,31B 'pgedg':23B,26B 'pl':41B 'pl-do':40B 'place':44B 'postgr':27B 'postgresql':24B,36B 'privileg':77B 'quot':55B 'read':73B 'role':82B 'run':33B,65B 'server':29B 'sql':34B,67B 'tag':56B 'tool':21B,43B 'transact':69B","search_c":"'1.1.0':101C,214C 'access':169C 'addit':160C 'affect':204C 'arbitrari':134C 'arg':139C 'argument':109C,123C,197C 'avail':174C 'bind':199C 'block':114C,131C,147C 'bypass':165C 'client':98C 'code':143C 'compat':97C 'connect':177C 'contain':124C 'context':95C 'control':164C 'could':128C,140C,158C 'custom':102C,126C,188C 'data':170C 'databas':92C 'delimit':115C 'dollar':119C 'dollar-quot':118C 'enabl':87C 'fix':117C,212C 'func':194C 'includ':159C 'inject':133C,141C,156C,207C 'interpol':107C 'issu':180C,210C 'json':108C 'least':183C 'mcp':85C,125C,138C 'mechan':208C 'model':94C 'modifi':172C 'one':184C 'paramet':200C 'pass':196C 'pgedg':83C 'pl':104C,186C,193C 'pl-do':103C,185C 'pl-func':192C 'plpgsql':146C 'postgr':84C 'postgresql':91C,112C 'prior':99C 'procedur':142C 'protocol':96C,155C 'queri':89C,154C 'quot':120C 'read':166C 'requir':181C 'resourc':173C 'role':178C 'server':86C 'simpl':153C 'sql':88C,135C,190C 'statement':136C,150C,161C 'tag':121C 'termin':129C 'text':157C 'tool':106C,127C,189C,195C 'transact':163C 'use':151C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:34:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126197","severity":null,"published_at":"2026-11-12T18:17:24+00:00","modified_at":"2026-11-12T18:17:24+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","fetched_at":"2026-11-12T18:40:38+00:00","note":null}],"documents":[{"id":137478,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116898,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":137483,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T08:34:52+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}