{"id":"CVE-2026-85787","kind":"vulnerability","aliases":["CVE-2026-85787"],"related":[],"title":"postgres-mcp-server: incomplete SQL filter lets crafted input modify data","description":"CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope\n\n### CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope\n\nBulletin ID: 2026-101-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/04/2026 13:00 PM PDT Last Updated Date: 09/08/2026 09:45 AM PDT\n\nDescription:\n\nWe have identified CVE-2026-85787, an incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server.\n\nImpacted versions: any pypi package version < 1.1.7\n\nResolution:\n\nThis issue has been addressed in version 1.1.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nRun the MCP server as a minimal-privilege Postgres role\n\nThe strongest control is to connect the MCP server using a dedicated Postgres role that has only the privileges it actually needs, so that the database itself enforces the boundary regardless of what SQL reaches it. In particular:\n\n- Do not connect as a superuser, rds_superuser, or the cluster master user. Those roles bypass row-level security, can read credential catalogs (pg_authid, pg_user_mappings), and can terminate other sessions.\n- For read-only use, grant only CONNECT + USAGE + SELECT on the schemas the agent needs, and force read-only transactions at the role level.\n- For read/write use, grant only the specific INSERT/UPDATE/DELETE privileges required, scoped to the necessary schemas and tables.\n\nCombining a minimal-privilege role (database-enforced) with the blocklist (application-enforced) gives you defense in depth: even if a query slips past the blocklist, the role's privileges still bound what it can do.\n\nReferences:\n\n- CVE-2026-85787\n- GHSA-pwr4-hmph-gqgc\n\nAcknowledgement:\n\nWe would like to thank Ashwak N for reporting this issue and working with us as part of our coordinated issue disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The SQL validation in AWS's awslabs postgres-mcp-server blocks only an incomplete list of disallowed statements, so crafted SQL can change data even when the server is meant to be read-only. An unauthenticated actor can plant that SQL in content an authenticated user later submits to the MCP server.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","lab-disclosure","mcp","postgres","postgres-mcp-server","python"],"not_affected_if":["no-mcp-server-deployed","version-1.1.7-or-later"],"how_to_check":"- Check the installed package version with `pip show awslabs.postgres-mcp-server` and confirm it is at least `1.1.7`\n- Check which Postgres role the MCP server connects as and whether it has INSERT, UPDATE or DELETE privileges, or superuser rights","fix":"- Upgrade the `awslabs.postgres-mcp-server` PyPI package to `1.1.7` or later\n- Patch any forked or derivative copy of the server with the upstream fixes\n- Connect the server with a minimal-privilege Postgres role that has only the SELECT (or specific write) grants it needs, and never a superuser or master role","status":"open","published_at":"2026-09-04T21:17:27+00:00","first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T05:30:01+00:00","updated_at":"2026-10-25T05:30:01+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T05:30:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `awslabs.postgres-mcp-server` PyPI package to `1.1.7` or later\n- Patch any forked or derivative copy of the server with the upstream fixes\n- Connect the server with a minimal-privilege Postgres role that has only the SELECT (or specific write) grants it needs, and never a superuser or master role","reach":"network","title":"postgres-mcp-server: incomplete SQL filter lets crafted input modify data","impact":"medium","summary":"The SQL validation in AWS's awslabs postgres-mcp-server blocks only an incomplete list of disallowed statements, so crafted SQL can change data even when the server is meant to be read-only. An unauthenticated actor can plant that SQL in content an authenticated user later submits to the MCP server.","category":"ai-tooling","nicknames":[],"who_cares":["postgres-mcp-server","mcp","python","postgres","aws"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker modifies database data beyond the intended read-only scope","analyst_note":"","how_to_check":"- Check the installed package version with `pip show awslabs.postgres-mcp-server` and confirm it is at least `1.1.7`\n- Check which Postgres role the MCP server connects as and whether it has INSERT, UPDATE or DELETE privileges, or superuser rights","needs_analyst":false,"not_affected_if":["version-1.1.7-or-later","no-mcp-server-deployed"],"who_is_affected":"Teams that run the awslabs postgres-mcp-server package below version 1.1.7 against a Postgres database, where AI agents send SQL to it on behalf of users. Exposure depends on whether the database role has write privileges, since the blocklist is the only check that failed. Teams on 1.1.7 or later, or those not running this MCP server, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4209,"output_tokens":679,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101':150C '-2026':14A,17A,88C,118C,179C,439C '-85787':15A,18A,89C,119C,180C,440C '00':163C '09':170C '09/04/2026':161C '09/08/2026':169C '1.1.7':201C,241C,250C '13':162C '2026':149C '45':171C 'acknowledg':446C 'actor':71B,206C 'actual':304C 'address':247C 'agent':370C 'ai':20B 'ai-tool':19B 'allow':203C 'amazon':102C,132C,193C 'applic':412C 'application-enforc':411C 'ashwak':452C 'attent':158C 'authent':79B,228C 'authid':347C 'aw':22B,37B,151C,153C 'aws-security@amazon.com':472C 'awslab':39B,103C,133C,194C 'beyond':111C,141C,210C 'block':44B 'blocklist':410C,426C 'bound':432C 'boundari':313C 'bulletin':147C 'bypass':337C 'catalog':345C 'chang':56B 'cluster':332C 'code':264C 'combin':399C 'compon':100C,130C,191C 'concern':478C 'connect':289C,324C,363C 'content':77B,154C,222C 'control':286C 'coordin':466C 'craft':9A,53B,218C 'credenti':344C 'cve':13A,16A,87C,117C,178C,438C 'data':12A,57B,110C,140C,209C 'databas':309C,406C 'database-enforc':405C 'date':160C,168C 'dedic':295C 'defens':416C 'depth':418C 'deriv':263C 'descript':174C 'disallow':50B,94C,124C,185C 'disclosur':25B,468C 'email':471C 'enforc':311C,407C,413C 'ensur':259C 'even':58B,419C 'filter':7A 'fix':271C 'forc':373C 'fork':261C 'ghsa':442C 'ghsa-pwr4-hmph-gqgc':441C 'give':414C 'gqgc':445C 'grant':361C,385C 'hmph':444C 'id':148C 'identifi':177C 'impact':235C 'import':156C 'incomplet':5A,47B,91C,121C,182C 'incorpor':268C 'input':10A,95C,125C,186C 'insert/update/delete':389C 'interact':230C 'issu':244C,457C,467C 'lab':24B 'lab-disclosur':23B 'last':166C 'later':81B 'latest':256C 'let':8A 'level':340C,381C 'like':449C 'list':48B,92C,122C,183C 'map':350C 'master':333C 'mcp':3A,26B,30B,42B,85B,106C,136C,197C,233C,275C,291C 'meant':63B 'might':202C 'minim':280C,402C 'minimal-privileg':279C,401C 'modifi':11A,109C,139C,208C 'n':453C 'necessari':395C 'need':305C,371C 'new':270C 'packag':239C 'part':463C 'particular':321C 'past':424C 'patch':266C 'pdt':165C,173C 'pg':346C,348C 'place':217C 'plant':73B 'pleas':470C 'pm':164C 'postgr':2A,27B,29B,41B,105C,135C,196C,282C,296C 'postgres-mcp-serv':1A,28B,40B,104C,134C,195C 'privileg':281C,302C,390C,403C,430C 'process':469C 'public':159C 'pwr4':443C 'pypi':238C 'python':32B 'queri':422C 'question':476C 'rds':328C 'reach':318C 'read':67B,114C,144C,213C,343C,358C,375C 'read-on':66B,113C,143C,212C,357C,374C 'read/write':383C 'recommend':252C 'refer':437C 'regardless':314C 'report':455C 'requir':157C,391C 'resolut':242C 'role':283C,297C,336C,380C,404C,428C 'row':339C 'row-level':338C 'run':273C 'schema':368C,396C 'scope':116C,146C,152C,215C,392C 'secur':341C,475C 'select':365C 'server':4A,31B,43B,61B,86B,107C,137C,198C,234C,276C,292C 'session':355C 'slip':423C 'specif':388C 'sql':6A,34B,54B,75B,98C,128C,189C,219C,317C 'statement':51B 'still':431C 'strongest':285C 'submit':82B,225C 'superus':327C,329C 'tabl':398C 'termin':353C 'thank':451C 'tool':21B 'transact':377C 'type':155C 'unauthent':70B,205C 'updat':167C 'upgrad':253C 'us':461C 'usag':364C 'use':293C,360C,384C 'user':80B,229C,334C,349C 'valid':35B,99C,129C,190C 'version':200C,236C,240C,249C,257C 'work':459C 'workaround':272C 'would':448C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the awslabs postgres-mcp-server package below version 1.1.7 against a Postgres database, where AI agents send SQL to it on behalf of users. Exposure depends on whether the database role has write privileges, since the blocklist is the only check that failed. Teams on 1.1.7 or later, or those not running this MCP server, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-04T21:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/#CVE-2026-85787","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"AWS: CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope"},{"source":"nvd","external_id":"CVE-2026-85787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85787","severity":null,"published_at":"2026-09-04T21:17:27+00:00","modified_at":"2026-09-08T16:18:19+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null}],"documents":[{"id":2886,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/","title":"AWS: CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope","kind":"advisory","source":"lab","text":"CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope\n\n### CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope\n\nBulletin ID: 2026-101-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/04/2026 13:00 PM PDT Last Updated Date: 09/08/2026 09:45 AM PDT\n\nDescription:\n\nWe have identified CVE-2026-85787, an incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server.\n\nImpacted versions: any pypi package version < 1.1.7\n\nResolution:\n\nThis issue has been addressed in version 1.1.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nRun the MCP server as a minimal-privilege Postgres role\n\nThe strongest control is to connect the MCP server using a dedicated Postgres role that has only the privileges it actually needs, so that the database itself enforces the boundary regardless of what SQL reaches it. In particular:\n\n- Do not connect as a superuser, rds_superuser, or the cluster master user. Those roles bypass row-level security, can read credential catalogs (pg_authid, pg_user_mappings), and can terminate other sessions.\n- For read-only use, grant only CONNECT + USAGE + SELECT on the schemas the agent needs, and force read-only transactions at the role level.\n- For read/write use, grant only the specific INSERT/UPDATE/DELETE privileges required, scoped to the necessary schemas and tables.\n\nCombining a minimal-privilege role (database-enforced) with the blocklist (application-enforced) gives you defense in depth: even if a query slips past the blocklist, the role's privileges still bound what it can do.\n\nReferences:\n\n- CVE-2026-85787\n- GHSA-pwr4-hmph-gqgc\n\nAcknowledgement:\n\nWe would like to thank Ashwak N for reporting this issue and working with us as part of our coordinated issue disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}