{"id":"CVE-2026-126198","kind":"vulnerability","aliases":["CVE-2026-126198"],"related":[],"title":"pgEdge Postgres MCP Server: write confirmation skipped for custom SQL tools","description":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0.","summary":"The bundled pgEdge MCP clients asked for write confirmation only for the query_database tool, so custom write tools ran without a prompt on allow_writes connections. An attacker who can steer the model with retrieved content can get unconfirmed database writes through those tools.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","mcp","pgedge","postgresql"],"not_affected_if":["allow-writes-off","no-custom-write-tools","read-only-use"],"how_to_check":"- Check the installed pgEdge Postgres MCP Server version with the package or binary version output; unknown if the sources do not give the exact command\n- Look for custom pl-do, pl-func or writing SQL tools and an `allow_writes` setting in the server configuration","fix":"- pgEdge Postgres MCP Server: move to `1.1.0` or later","status":"open","published_at":"2026-11-12T18:17:24+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","triaged_at":"2026-11-12T18:43:07+00:00","updated_at":"2026-11-12T18:43:07+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-12T18:43:07Z","model":"claude-haiku-5-5","output":{"fix":"- pgEdge Postgres MCP Server: move to `1.1.0` or later","reach":"unknown","title":"pgEdge Postgres MCP Server: write confirmation skipped for custom SQL tools","impact":"medium","summary":"The bundled pgEdge MCP clients asked for write confirmation only for the query_database tool, so custom write tools ran without a prompt on allow_writes connections. An attacker who can steer the model with retrieved content can get unconfirmed database writes through those tools.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mcp","postgresql","pgedge","ai-agents"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"unconfirmed database writes made by the model through custom tools","analyst_note":"Check the 1.1.0 release notes and patch on github.com to confirm the fixed version and the exact affected configuration.","how_to_check":"- Check the installed pgEdge Postgres MCP Server version with the package or binary version output; unknown if the sources do not give the exact command\n- Look for custom pl-do, pl-func or writing SQL tools and an `allow_writes` setting in the server configuration","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["allow-writes-off","read-only-use","no-custom-write-tools"],"who_is_affected":"Teams running the pgEdge Postgres MCP Server with allow_writes enabled and custom write tools such as pl-do, pl-func or other SQL-writing tools. The issue is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt, so the risk sits with how the bundled CLI or web client is used. Teams with allow_writes off or read-only use can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000807,"input_tokens":4717,"output_tokens":670,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-126198':14A,17A '-2026':13A,16A '1.1.0':90C,179C 'affect':151C 'agent':20B 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'allow':51B,138C 'annot':121C 'ask':32B 'attack':55B 'author':163C 'boundari':164C 'bundl':28B,92C,156C 'bundled-cli':155C 'check':107C 'cli':96C 'client':31B,87C,93C,99C,157C,168C 'compat':86C 'confirm':6A,35B,105C,136C 'connect':53B,140C 'content':63B,149C 'context':84C 'control':152C 'custom':9A,43B,122C 'cve':12A,15A 'databas':40B,67B,81C,112C 'decid':100C 'enabl':76C 'fix':177C 'follow':145C 'func':128C 'get':65B 'includ':94C,141C 'inherit':171C 'instead':115C 'instruct':146C 'issu':175C 'mcp':3A,24B,30B,74C,167C 'model':60B,83C,144C 'name':114C 'pgedg':1A,25B,29B,72C 'pl':124C,127C 'pl-do':123C 'pl-func':126C 'postgr':2A,73C 'postgresql':26B,80C 'prior':88C 'prompt':49B,173C 'protocol':85C 'publish':119C 'queri':39B,78C,111C 'ran':46B,134C 'rather':159C 'request':103C 'retriev':62B,148C 'server':4A,75C,118C,162C 'server-publish':117C 'skip':7A 'sql':10A,77C,131C 'steer':58B 'therefor':133C 'tool':11A,23B,41B,45B,71B,113C,132C 'unconfirm':66B 'warn':158C 'web':98C 'whether':101C 'without':47B,135C 'write':5A,34B,44B,52B,68B,104C,120C,130C,139C","nicknames":[],"mitigations":[],"who_affected":"Teams running the pgEdge Postgres MCP Server with allow_writes enabled and custom write tools such as pl-do, pl-func or other SQL-writing tools. The issue is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt, so the risk sits with how the bundled CLI or web client is used. Teams with allow_writes off or read-only use can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","low","mcp","pgedge","postgresql"],"campaign_type":null,"search_a":"'-126198':14A,17A '-2026':13A,16A 'confirm':6A 'custom':9A 'cve':12A,15A 'mcp':3A 'pgedg':1A 'postgr':2A 'server':4A 'skip':7A 'sql':10A 'tool':11A 'write':5A","search_b":"'agent':20B 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'allow':51B 'ask':32B 'attack':55B 'bundl':28B 'client':31B 'confirm':35B 'connect':53B 'content':63B 'custom':43B 'databas':40B,67B 'get':65B 'mcp':24B,30B 'model':60B 'pgedg':25B,29B 'postgresql':26B 'prompt':49B 'queri':39B 'ran':46B 'retriev':62B 'steer':58B 'tool':23B,41B,45B,71B 'unconfirm':66B 'without':47B 'write':34B,44B,52B,68B","search_c":"'1.1.0':90C,179C 'affect':151C 'allow':138C 'annot':121C 'author':163C 'boundari':164C 'bundl':92C,156C 'bundled-cli':155C 'check':107C 'cli':96C 'client':87C,93C,99C,157C,168C 'compat':86C 'confirm':105C,136C 'connect':140C 'content':149C 'context':84C 'control':152C 'custom':122C 'databas':81C,112C 'decid':100C 'enabl':76C 'fix':177C 'follow':145C 'func':128C 'includ':94C,141C 'inherit':171C 'instead':115C 'instruct':146C 'issu':175C 'mcp':74C,167C 'model':83C,144C 'name':114C 'pgedg':72C 'pl':124C,127C 'pl-do':123C 'pl-func':126C 'postgr':73C 'postgresql':80C 'prior':88C 'prompt':173C 'protocol':85C 'publish':119C 'queri':78C,111C 'ran':134C 'rather':159C 'request':103C 'retriev':148C 'server':75C,118C,162C 'server-publish':117C 'sql':77C,131C 'therefor':133C 'tool':113C,132C 'warn':158C 'web':98C 'whether':101C 'without':135C 'write':104C,120C,130C,139C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-03T12:41:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126198","severity":null,"published_at":"2026-11-12T18:17:24+00:00","modified_at":"2026-11-12T18:17:24+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","fetched_at":"2026-11-12T18:40:38+00:00","note":null}],"documents":[{"id":137484,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116898,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":137486,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T12:41:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}