---
id: "CVE-2026-126198"
page: "https://infrastack.ai/live/CVE-2026-126198"
kind: "vulnerability"
aliases: ["CVE-2026-126198"]
title: "pgEdge Postgres MCP Server: write confirmation skipped for custom SQL tools"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "mcp", "pgedge", "postgresql"]
not_affected_if: ["allow-writes-off", "no-custom-write-tools", "read-only-use"]
published_at: "2026-11-12T18:17:24+00:00"
first_seen_at: "2026-11-12T18:40:38+00:00"
updated_at: "2026-11-12T18:43:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126198", "first_seen_at": "2026-11-12T18:40:38+00:00"}]
exploit_sources: []
---

# pgEdge Postgres MCP Server: write confirmation skipped for custom SQL tools

Link for people: https://infrastack.ai/live/CVE-2026-126198 (this .md is for agents)

The bundled pgEdge MCP clients asked for write confirmation only for the query_database tool, so custom write tools ran without a prompt on allow_writes connections. An attacker who can steer the model with retrieved content can get unconfirmed database writes through those tools.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed pgEdge Postgres MCP Server version with the package or binary version output; unknown if the sources do not give the exact command
- Look for custom pl-do, pl-func or writing SQL tools and an `allow_writes` setting in the server configuration

## Fix

- pgEdge Postgres MCP Server: move to `1.1.0` or later

## Timeline

- 2026-11-12T18:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126198

## Documents

- [advisory] Vendor advisory: github.com https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc
- [fix] Patch: github.com https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90
- [fix] Release notes: github.com https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0

## From the sources

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_