---
id: "CVE-2026-126197"
page: "https://infrastack.ai/live/CVE-2026-126197"
kind: "vulnerability"
aliases: ["CVE-2026-126197"]
title: "pgEdge Postgres MCP Server: crafted tool arguments inject SQL into the database"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "mcp", "pgedge", "postgresql"]
not_affected_if: ["no-pl-do-tools", "sql-or-pl-func-tools-only", "version-1.1.0-or-later"]
published_at: "2026-11-12T18:17:24+00:00"
first_seen_at: "2026-11-12T18:40:38+00:00"
updated_at: "2026-11-12T18:42:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126197", "first_seen_at": "2026-11-12T18:40:38+00:00"}]
exploit_sources: []
---

# pgEdge Postgres MCP Server: crafted tool arguments inject SQL into the database

Link for people: https://infrastack.ai/live/CVE-2026-126197 (this .md is for agents)

The pgEdge Postgres MCP Server lets MCP clients run SQL against PostgreSQL. Before 1.1.0, custom pl-do tools placed JSON arguments into a DO block with fixed dollar-quote tags, so a crafted argument can break out and run extra SQL, including transaction control that bypasses read_only, with the privileges of the connecting database role.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether any custom tool in the server configuration uses the `pl-do` type; only those are affected.
- Check the server version; versions below `1.1.0` are affected.

## Fix

- pgEdge Postgres MCP Server: upgrade to `1.1.0`.

## Timeline

- 2026-11-12T18:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126197

## Documents

- [advisory] Vendor advisory: github.com https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9
- [fix] Patch: github.com https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868
- [fix] Release notes: github.com https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0

## From the sources

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_