--- id: "CVE-2026-85787" kind: "vulnerability" aliases: ["CVE-2026-85787"] title: "postgres-mcp-server: incomplete SQL filter lets crafted input modify data" severity: "high" cvss: 7.1 epss: 0.00342 exploited: false status: "open" category: "ai-tooling" products: [] ecosystems: [] tags: ["ai-tooling", "aws", "lab-disclosure", "mcp", "postgres", "postgres-mcp-server", "python"] not_affected_if: ["no-mcp-server-deployed", "version-1.1.7-or-later"] published_at: "2026-09-04T21:17:27+00:00" first_seen_at: "2026-10-24T18:43:45+00:00" updated_at: "2026-10-25T12:38:49+00:00" sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/", "first_seen_at": "2026-10-24T18:43:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85787", "first_seen_at": "2026-10-24T18:53:56+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-85787", "first_seen_at": "2026-10-25T12:38:49+00:00"}] --- # postgres-mcp-server: incomplete SQL filter lets crafted input modify data The SQL validation in AWS's awslabs postgres-mcp-server blocks only an incomplete list of disallowed statements, so crafted SQL can change data even when the server is meant to be read-only. An unauthenticated actor can plant that SQL in content an authenticated user later submits to the MCP server. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Check the installed package version with `pip show awslabs.postgres-mcp-server` and confirm it is at least `1.1.7` - Check which Postgres role the MCP server connects as and whether it has INSERT, UPDATE or DELETE privileges, or superuser rights ## Fix - Upgrade the `awslabs.postgres-mcp-server` PyPI package to `1.1.7` or later - Patch any forked or derivative copy of the server with the upstream fixes - Connect the server with a minimal-privilege Postgres role that has only the SELECT (or specific write) grants it needs, and never a superuser or master role ## Timeline - 2026-10-24T18:43:45+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/ — AWS: CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope - 2026-10-24T18:53:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85787 - 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-85787 ## Documents - [advisory] AWS: CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/ ## From the sources CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope ### CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope Bulletin ID: 2026-101-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/04/2026 13:00 PM PDT Last Updated Date: 09/08/2026 09:45 AM PDT Description: We have identified CVE-2026-85787, an incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server. Impacted versions: any pypi package version < 1.1.7 Resolution: This issue has been addressed in version 1.1.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds: Run the MCP server as a minimal-privilege Postgres role The strongest control is to connect the MCP server using a dedicated Postgres role that has only the privileges it actually needs, so that the database itself enforces the boundary regardless of what SQL reaches it. In particular: - Do not connect as a superuser, rds_superuser, or the cluster master user. Those roles bypass row-level security, can read credential catalogs (pg_authid, pg_user_mappings), and can terminate other sessions. - For read-only use, grant only CONNECT + USAGE + SELECT on the schemas the agent needs, and force read-only transactions at the role level. - For read/write use, grant only the specific INSERT/UPDATE/DELETE privileges required, scoped to the necessary schemas and tables. Combining a minimal-privilege role (database-enforced) with the blocklist (application-enforced) gives you defense in depth: even if a query slips past the blocklist, the role's privileges still bound what it can do. References: - CVE-2026-85787 - GHSA-pwr4-hmph-gqgc Acknowledgement: We would like to thank Ashwak N for reporting this issue and working with us as part of our coordinated issue disclosure process. Please email aws-security@amazon.com with any security questions or concerns. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_