{"id":"CVE-2026-126199","kind":"vulnerability","aliases":["CVE-2026-126199"],"related":[],"title":"pgEdge Postgres MCP Server: writes ran without confirmation on allow_writes connections","description":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query_database statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allow_writes connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0.","summary":"The pgEdge Postgres MCP Server, which lets AI clients run SQL against PostgreSQL, classified some write statements as reads, such as SELECT INTO, data-modifying WITH queries and EXPLAIN ANALYZE of a write. On connections with allow_writes enabled, those statements ran without the write confirmation prompt.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","mcp","pgedge","postgres"],"not_affected_if":["read-only-connections","version-1.1.0-or-later"],"how_to_check":"- Check the installed pgEdge Postgres MCP Server version; versions before `1.1.0` are affected.\n- Look for connections configured with `allow_writes` enabled in the server configuration.","fix":"- Upgrade pgEdge Postgres MCP Server to `1.1.0` or later.","status":"open","published_at":"2026-11-12T18:17:25+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","triaged_at":"2026-11-12T18:42:53+00:00","updated_at":"2026-11-12T18:42:53+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-12T18:42:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pgEdge Postgres MCP Server to `1.1.0` or later.","reach":"network","title":"pgEdge Postgres MCP Server: writes ran without confirmation on allow_writes connections","impact":"medium","summary":"The pgEdge Postgres MCP Server, which lets AI clients run SQL against PostgreSQL, classified some write statements as reads, such as SELECT INTO, data-modifying WITH queries and EXPLAIN ANALYZE of a write. On connections with allow_writes enabled, those statements ran without the write confirmation prompt.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["pgedge","postgres","mcp","ai-agents"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"unconfirmed database writes on allow_writes connections","analyst_note":"","how_to_check":"- Check the installed pgEdge Postgres MCP Server version; versions before `1.1.0` are affected.\n- Look for connections configured with `allow_writes` enabled in the server configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["read-only-connections","version-1.1.0-or-later"],"who_is_affected":"Teams running the pgEdge Postgres MCP Server before 1.1.0 with an allow_writes connection, where an AI client or the bundled CLI and web clients can issue SQL. Read-only connections are protected by PostgreSQL transaction access mode, so they are not exposed to this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000771,"input_tokens":4740,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126199':15A,18A '-2026':14A,17A '1.1.0':94C,177C 'access':158C 'agent':21B 'ai':20B,23B,35B 'ai-ag':19B 'ai-tool':22B 'allow':10A,65B,146C 'analyz':58B,131C,163C 'begin':126C 'bundl':96C 'classifi':41B,101C,169C 'cli':97C 'client':36B,91C,100C 'common':123C 'compat':90C 'confirm':8A,74B,117C,143C 'connect':12A,63B,148C,152C 'context':88C 'could':140C 'cve':13A,16A 'data':52B,121C 'data-modifi':51B,120C 'databas':85C,103C 'decid':111C 'display':114C 'enabl':67B,80C 'execut':141C 'explain':57B,130C,161C 'express':125C 'first':108C 'fix':175C 'issu':173C 'keyword':109C 'let':34B 'mcp':3A,25B,31B,78C 'mode':159C 'model':87C 'modifi':53B,122C 'pgedg':1A,26B,29B,76C 'postgr':2A,27B,30B,77C 'postgresql':40B,84C,156C 'prior':92C 'prompt':75B 'protect':154C 'protocol':89C 'queri':55B,82C,102C 'ran':6A,70B 'read':46B,138C,150C,171C 'read-on':149C 'remain':153C,168C 'run':37B 'select':49B,118C,165C 'server':4A,32B,79C 'sql':38B,81C 'statement':44B,69B,104C 'tabl':124C 'tool':24B 'transact':157C 'treat':136C 'updat':167C 'web':99C 'whether':112C 'without':7A,71B,142C,162C 'write':5A,11A,43B,61B,66B,73B,116C,134C,147C","nicknames":[],"mitigations":[],"who_affected":"Teams running the pgEdge Postgres MCP Server before 1.1.0 with an allow_writes connection, where an AI client or the bundled CLI and web clients can issue SQL. Read-only connections are protected by PostgreSQL transaction access mode, so they are not exposed to this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","mcp","medium","pgedge","postgres"],"campaign_type":null,"search_a":"'-126199':15A,18A '-2026':14A,17A 'allow':10A 'confirm':8A 'connect':12A 'cve':13A,16A 'mcp':3A 'pgedg':1A 'postgr':2A 'ran':6A 'server':4A 'without':7A 'write':5A,11A","search_b":"'agent':21B 'ai':20B,23B,35B 'ai-ag':19B 'ai-tool':22B 'allow':65B 'analyz':58B 'classifi':41B 'client':36B 'confirm':74B 'connect':63B 'data':52B 'data-modifi':51B 'enabl':67B 'explain':57B 'let':34B 'mcp':25B,31B 'modifi':53B 'pgedg':26B,29B 'postgr':27B,30B 'postgresql':40B 'prompt':75B 'queri':55B 'ran':70B 'read':46B 'run':37B 'select':49B 'server':32B 'sql':38B 'statement':44B,69B 'tool':24B 'without':71B 'write':43B,61B,66B,73B","search_c":"'1.1.0':94C,177C 'access':158C 'allow':146C 'analyz':131C,163C 'begin':126C 'bundl':96C 'classifi':101C,169C 'cli':97C 'client':91C,100C 'common':123C 'compat':90C 'confirm':117C,143C 'connect':148C,152C 'context':88C 'could':140C 'data':121C 'data-modifi':120C 'databas':85C,103C 'decid':111C 'display':114C 'enabl':80C 'execut':141C 'explain':130C,161C 'express':125C 'first':108C 'fix':175C 'issu':173C 'keyword':109C 'mcp':78C 'mode':159C 'model':87C 'modifi':122C 'pgedg':76C 'postgr':77C 'postgresql':84C,156C 'prior':92C 'protect':154C 'protocol':89C 'queri':82C,102C 'read':138C,150C,171C 'read-on':149C 'remain':153C,168C 'select':118C,165C 'server':79C 'sql':81C 'statement':104C 'tabl':124C 'transact':157C 'treat':136C 'updat':167C 'web':99C 'whether':112C 'without':142C,162C 'write':116C,134C,147C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:34:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126199","severity":null,"published_at":"2026-11-12T18:17:25+00:00","modified_at":"2026-11-12T18:17:25+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","fetched_at":"2026-11-12T18:40:39+00:00","note":null}],"documents":[{"id":137487,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/310c02809891cfaee6e4891cd7bb9aa1d459575c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116898,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":137489,"url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-5gmh-9683-hhq9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T08:34:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}