{"id":"CVE-2026-87911","kind":"vulnerability","aliases":["CVE-2026-87911"],"related":[],"title":"AWS Postgres MCP server: read-only bypass allows OS commands on host","description":"CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server\n\n### CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server\n\nBulletin ID: 2026-104-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/09/2026 12:30 PM PDT\n\nDescription:\n\nawslabs.postgres-mcp-server is a python package that implements a Postgres MCP server. We found CVE-2026-87911, where an OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode.\n\nImpacted versions:\n\nawslabs.postgres-mcp-server before 1.1.7, self-managed PostgreSQL deployment profile (PG_WIRE_PROTOCOL connection method) where the configured database role holds superuser or pg_execute_server_program.\n\nResolution:\n\nThis issue has been addressed in awslabs postgres-mcp-server (python package) version 1.1.7 in pypi.\n\nWorkarounds:\n\nThe strongest control is to connect the MCP server using a dedicated Postgres role that has only the privileges it actually needs, so that the database itself enforces the boundary regardless of what SQL reaches it. In particular:\n\n- Do not connect as a superuser, rds_superuser, or the cluster master user. Those roles bypass row-level security, can read credential catalogs (pg_authid, pg_user_mappings), and can terminate other sessions.\n- For read-only use, grant only CONNECT + USAGE + SELECT on the schemas the agent needs, and force read-only transactions at the role level.\n- For read/write use, grant only the specific INSERT/UPDATE/DELETE privileges required, scoped to the necessary schemas and tables.\n\nCombining a minimal-privilege role (database-enforced) with the blocklist (application-enforced) gives you defense in depth: even if a query slips past the blocklist, the role's privileges still bound what it can do.\n\nReferences:\n\n- CVE-2026-87911\n- GHSA-fph8-pg5w-78fv\n\nAcknowledgement:\n\nWe would like to thank Mordehai Attia (Corsen AI) and Ryan von Brubeck for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The awslabs postgres-mcp-server Python package before 1.1.7 fails to block COPY ... TO PROGRAM statements in its read-only SQL validation. Crafted content processed by an authenticated user of the MCP server can make the PostgreSQL host run operating system commands.","severity":"critical","cvss":9.6,"epss":0.01738,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","lab-disclosure","mcp","postgres","python","self-hosted"],"not_affected_if":["least-privilege-db-role","managed-postgres-profile","version-1.1.7-or-later"],"how_to_check":"- Check the installed version with `pip show awslabs.postgres-mcp-server` and confirm it is `1.1.7` or later.\n- Check whether the server uses the self-managed PostgreSQL profile (PG_WIRE_PROTOCOL connection method).\n- Check whether the database role the server connects with is a superuser or holds pg_execute_server_program.","fix":"- Upgrade awslabs.postgres-mcp-server to `1.1.7` or later from PyPI.\n- Connect the MCP server with a dedicated least-privilege Postgres role, not a superuser, rds_superuser or the master user.\n- Remove pg_execute_server_program and superuser from the role the server uses.","status":"open","published_at":"2026-09-09T00:00:00+00:00","first_seen_at":"2026-10-24T20:05:36+00:00","triaged_at":"2026-10-25T05:29:13+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T05:29:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade awslabs.postgres-mcp-server to `1.1.7` or later from PyPI.\n- Connect the MCP server with a dedicated least-privilege Postgres role, not a superuser, rds_superuser or the master user.\n- Remove pg_execute_server_program and superuser from the role the server uses.","reach":"network","title":"AWS Postgres MCP server: read-only bypass allows OS commands on host","impact":"high","summary":"The awslabs postgres-mcp-server Python package before 1.1.7 fails to block COPY ... TO PROGRAM statements in its read-only SQL validation. Crafted content processed by an authenticated user of the MCP server can make the PostgreSQL host run operating system commands.","category":"ai-tooling","nicknames":[],"who_cares":["postgres","mcp","self-hosted","python","aws"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs operating system commands on the PostgreSQL host","analyst_note":"Confirm the affected role and profile conditions against the GHSA-fph8-pg5w-78fv advisory and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-87911.","how_to_check":"- Check the installed version with `pip show awslabs.postgres-mcp-server` and confirm it is `1.1.7` or later.\n- Check whether the server uses the self-managed PostgreSQL profile (PG_WIRE_PROTOCOL connection method).\n- Check whether the database role the server connects with is a superuser or holds pg_execute_server_program.","needs_analyst":true,"not_affected_if":["version-1.1.7-or-later","managed-postgres-profile","least-privilege-db-role"],"who_is_affected":"Teams running the AWS Labs Postgres MCP server against a self-managed PostgreSQL server, where the configured role is a superuser or holds pg_execute_server_program. The read-only default mode does not stop the flaw, so the database role is what bounds the risk. Teams on RDS or Aurora-managed profiles, or with a least-privilege role, face a lower risk, and anyone already on 1.1.7 or later is fixed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000826,"input_tokens":4273,"output_tokens":797,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-104':130C '-2026':15A,18A,78C,103C,164C,446C '-87911':16A,19A,79C,104C,165C,447C '09/09/2026':141C '1.1.7':42B,191C,248C,287C '12':142C '2026':129C '30':143C '78fv':452C 'acknowledg':453C 'actor':196C 'actual':311C 'address':277C 'agent':377C 'ai':21B,462C 'ai-tool':20B 'allow':9A,193C 'amazon':96C,121C,184C 'applic':419C 'application-enforc':418C 'attent':138C 'attia':460C 'authent':62B,227C 'authid':354C 'aw':1A,23B,131C,133C 'aws-security@amazon.com':480C 'awslab':34B,97C,122C,185C,279C 'awslabs.postgres':147C,243C 'block':45B 'blocklist':417C,433C 'bound':439C 'boundari':320C 'brubeck':466C 'bulletin':127C 'bypass':8A,84C,109C,344C 'catalog':352C 'cluster':339C 'collabor':468C 'combin':406C 'command':11A,76B,88C,113C,169C,201C 'compon':94C,119C,182C 'concern':486C 'configur':262C 'connect':258C,296C,331C,370C 'content':58B,134C,221C 'control':293C 'coordin':474C 'copi':46B,216C 'corsen':461C 'craft':57B,215C 'credenti':351C 'cve':14A,17A,77C,102C,163C,445C 'databas':263C,316C,413C 'database-enforc':412C 'date':140C 'dedic':302C 'default':236C 'defens':423C 'deploy':253C 'depth':425C 'descript':146C 'disclosur':26B,476C 'email':479C 'enabl':85C,110C 'enforc':83C,108C,177C,318C,414C,420C 'even':426C 'execut':89C,114C,198C,269C 'fail':43B 'forc':380C 'found':162C 'fph8':450C 'ghsa':449C 'ghsa-fph8-pg5w-78fv':448C 'give':421C 'grant':368C,392C 'hold':265C 'host':13A,32B,72B,204C 'id':128C 'impact':241C 'implement':156C 'import':136C 'inject':170C 'insert/update/delete':396C 'interact':229C 'issu':274C,471C 'lab':25B 'lab-disclosur':24B 'level':347C,388C 'like':456C 'make':69B 'manag':209C,251C 'map':357C 'master':340C 'mcp':3A,27B,37B,66B,100C,125C,149C,159C,188C,232C,245C,282C,298C 'mcp-server':148C,244C 'method':259C 'might':192C 'minim':409C 'minimal-privileg':408C 'mode':240C 'mordehai':459C 'necessari':402C 'need':312C,378C 'oper':74B,86C,111C,199C 'os':10A,168C 'packag':40B,154C,285C 'particular':328C 'past':431C 'pdt':145C 'pg':255C,268C,353C,355C 'pg5w':451C 'place':213C 'pleas':478C 'pm':144C 'postgr':2A,28B,36B,99C,124C,158C,187C,281C,303C 'postgres-mcp-serv':35B,98C,123C,186C,280C 'postgresql':71B,210C,252C 'privileg':309C,397C,410C,437C 'process':59B,224C,477C 'profil':254C 'program':48B,218C,271C 'protocol':257C 'public':139C 'pypi':289C 'python':29B,39B,153C,284C 'queri':429C 'question':484C 'rds':335C 'reach':325C 'read':6A,53B,81C,106C,175C,238C,350C,365C,382C 'read-on':5A,52B,80C,105C,174C,237C,364C,381C 'read/write':390C 'refer':444C 'regardless':321C 'requir':137C,398C 'resolut':272C 'role':264C,304C,343C,387C,411C,435C 'row':346C 'row-level':345C 'run':73B 'ryan':464C 'schema':375C,403C 'scope':132C,399C 'secur':348C,483C 'select':372C 'self':31B,208C,250C 'self-host':30B 'self-manag':207C,249C 'server':4A,38B,67B,101C,126C,150C,160C,189C,211C,233C,246C,270C,283C,299C 'session':362C 'slip':430C 'specif':395C 'sql':55B,92C,117C,180C,324C 'statement':49B,219C 'still':438C 'strongest':292C 'superus':266C,334C,336C 'system':75B,87C,112C,200C 'tabl':405C 'termin':360C 'thank':458C 'tool':22B 'transact':384C 'type':135C 'unauthent':195C 'usag':371C 'use':300C,367C,391C 'user':63B,228C,341C,356C 'valid':56B,93C,118C,181C 'version':242C,286C 'von':465C 'vulner':475C 'weak':171C 'wire':256C 'workaround':290C 'would':455C","nicknames":[],"mitigations":[],"who_affected":"Teams running the AWS Labs Postgres MCP server against a self-managed PostgreSQL server, where the configured role is a superuser or holds pg_execute_server_program. The read-only default mode does not stop the flaw, so the database role is what bounds the risk. Teams on RDS or Aurora-managed profiles, or with a least-privilege role, face a lower risk, and anyone already on 1.1.7 or later is fixed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-09T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-104-aws/#CVE-2026-87911","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-104-aws/","severity":null,"published_at":"2026-09-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T20:05:36+00:00","fetched_at":"2026-10-24T20:05:36+00:00","note":"AWS: CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server"},{"source":"nvd","external_id":"CVE-2026-87911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87911","severity":null,"published_at":"2026-09-09T20:21:02+00:00","modified_at":"2026-09-10T15:53:23+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87911","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87911","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2973,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-104-aws/","title":"AWS: CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server","kind":"advisory","source":"lab","text":"CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server\n\n### CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server\n\nBulletin ID: 2026-104-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/09/2026 12:30 PM PDT\n\nDescription:\n\nawslabs.postgres-mcp-server is a python package that implements a Postgres MCP server. We found CVE-2026-87911, where an OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode.\n\nImpacted versions:\n\nawslabs.postgres-mcp-server before 1.1.7, self-managed PostgreSQL deployment profile (PG_WIRE_PROTOCOL connection method) where the configured database role holds superuser or pg_execute_server_program.\n\nResolution:\n\nThis issue has been addressed in awslabs postgres-mcp-server (python package) version 1.1.7 in pypi.\n\nWorkarounds:\n\nThe strongest control is to connect the MCP server using a dedicated Postgres role that has only the privileges it actually needs, so that the database itself enforces the boundary regardless of what SQL reaches it. In particular:\n\n- Do not connect as a superuser, rds_superuser, or the cluster master user. Those roles bypass row-level security, can read credential catalogs (pg_authid, pg_user_mappings), and can terminate other sessions.\n- For read-only use, grant only CONNECT + USAGE + SELECT on the schemas the agent needs, and force read-only transactions at the role level.\n- For read/write use, grant only the specific INSERT/UPDATE/DELETE privileges required, scoped to the necessary schemas and tables.\n\nCombining a minimal-privilege role (database-enforced) with the blocklist (application-enforced) gives you defense in depth: even if a query slips past the blocklist, the role's privileges still bound what it can do.\n\nReferences:\n\n- CVE-2026-87911\n- GHSA-fph8-pg5w-78fv\n\nAcknowledgement:\n\nWe would like to thank Mordehai Attia (Corsen AI) and Ryan von Brubeck for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-09-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}