Live › vulnerability › GHSA-fph8-pg5w-78fv
Go to dashboardThe awslabs postgres-mcp-server Python package before 1.1.7 has an OS command injection flaw in its read-only SQL validation: a crafted COPY ... TO PROGRAM statement placed in content the MCP server processes can run commands on the host of a self-managed PostgreSQL server. The advisory says an unauthenticated actor can plant the statement, but it fires when an authenticated user interacts with the server in its default read-only mode.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 20:05 UTC. All times on this page are UTC.
Teams running awslabs postgres-mcp-server before 1.1.7 against a self-managed PostgreSQL server where the configured role is a superuser or holds pg_execute_server_program. The exploit needs that privileged role, so a server connected through a least-privilege role is limited to what that role can do. Managed-database deployments outside the self-managed profile are not described as affected.
No product ranges from the sources yet.
awslabs.postgres-mcp-server package (for example pip show awslabs.postgres-mcp-server); anything below 1.1.7 is exposed.pg_execute_server_program, for example with SELECT rolsuper FROM pg_roles WHERE rolname = current_user; and SELECT pg_has_role(current_user, 'pg_execute_server_program', 'MEMBER');.awslabs.postgres-mcp-server to 1.1.7 or later from PyPI.pg_execute_server_program, granting only the CONNECT, USAGE and SELECT (or specific write) privileges the agent needs.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server
Bulletin ID: 2026-104-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/09/2026 12:30 PM PDT
Description:
awslabs.postgres-mcp-server is a python package that implements a Postgres MCP server. We found CVE-2026-87911, where an OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode.
Impacted versions:
awslabs.postgres-mcp-server before 1.1.7, self-managed PostgreSQL deployment profile (PG_WIRE_PROTOCOL connection method) where the configured database role holds superuser or pg_execute_server_program.
Resolution:
This issue has been addressed in awslabs postgres-mcp-server (python package) version 1.1.7 in pypi.
Workarounds:
The strongest control is to connect the MCP server using a dedicated Postgres role that has only the privileges it actually needs, so that the database itself enforces the boundary regardless of what SQL reaches it. In particular:
Combining a minimal-privilege role (database-enforced) with the blocklist (application-enforced) gives you defense in depth: even if a query slips past the blocklist, the role's privileges still bound what it can do.
References:
Acknowledgement:
We would like to thank Mordehai Attia (Corsen AI) and Ryan von Brubeck for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-fph8-pg5w-78fv")