{"id":"GHSA-pwr4-hmph-gqgc","kind":"vulnerability","aliases":["GHSA-pwr4-hmph-gqgc"],"related":[],"title":"CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope","description":"CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope\n\n### CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope\n\nBulletin ID: 2026-101-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/04/2026 13:00 PM PDT Last Updated Date: 09/08/2026 09:45 AM PDT\n\nDescription:\n\nWe have identified CVE-2026-85787, an incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server.\n\nImpacted versions: any pypi package version < 1.1.7\n\nResolution:\n\nThis issue has been addressed in version 1.1.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nRun the MCP server as a minimal-privilege Postgres role\n\nThe strongest control is to connect the MCP server using a dedicated Postgres role that has only the privileges it actually needs, so that the database itself enforces the boundary regardless of what SQL reaches it. In particular:\n\n- Do not connect as a superuser, rds_superuser, or the cluster master user. Those roles bypass row-level security, can read credential catalogs (pg_authid, pg_user_mappings), and can terminate other sessions.\n- For read-only use, grant only CONNECT + USAGE + SELECT on the schemas the agent needs, and force read-only transactions at the role level.\n- For read/write use, grant only the specific INSERT/UPDATE/DELETE privileges required, scoped to the necessary schemas and tables.\n\nCombining a minimal-privilege role (database-enforced) with the blocklist (application-enforced) gives you defense in depth: even if a query slips past the blocklist, the role's privileges still bound what it can do.\n\nReferences:\n\n- CVE-2026-85787\n- GHSA-pwr4-hmph-gqgc\n\nAcknowledgement:\n\nWe would like to thank Ashwak N for reporting this issue and working with us as part of our coordinated issue disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The SQL validation component in awslabs postgres-mcp-server, meant to enforce read-only access, does not block every disallowed input. Crafted SQL placed in content submitted to the MCP server can modify data beyond the read-only scope.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","aws","lab-disclosure","mcp","postgres","python"],"not_affected_if":["version-1.1.7-or-later"],"how_to_check":"- Check the installed version of the awslabs postgres-mcp-server package with `pip show postgres-mcp` or `pip freeze | grep -i postgres-mcp`; anything below `1.1.7` is affected\n- Check whether the server connects to Postgres with a superuser, rds_superuser or master role, since those roles make the impact worse","fix":"- Upgrade the awslabs postgres-mcp-server PyPI package to `1.1.7` or later\n- Patch any forked or derivative copies of the server to include the fix\n- Connect the MCP server with a dedicated minimal-privilege Postgres role, granting only the SELECT (or specific INSERT/UPDATE/DELETE) privileges it needs","status":"open","published_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T04:51:42+00:00","updated_at":"2026-10-25T04:51:42+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T04:51:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the awslabs postgres-mcp-server PyPI package to `1.1.7` or later\n- Patch any forked or derivative copies of the server to include the fix\n- Connect the MCP server with a dedicated minimal-privilege Postgres role, granting only the SELECT (or specific INSERT/UPDATE/DELETE) privileges it needs","reach":"unknown","title":"AWS postgres-mcp-server: incomplete SQL blocklist lets crafted input modify data","impact":"medium","summary":"The SQL validation component in awslabs postgres-mcp-server, meant to enforce read-only access, does not block every disallowed input. Crafted SQL placed in content submitted to the MCP server can modify data beyond the read-only scope.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","postgres","python","aws","ai-agents"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker modifies database data beyond the intended read-only scope","analyst_note":"Confirm the attack path and any exploitation details at the AWS bulletin 2026-101-AWS and the GHSA-pwr4-hmph-gqgc advisory; sources do not state the CVSS severity or whether the flaw is reachable without the authenticated user step.","how_to_check":"- Check the installed version of the awslabs postgres-mcp-server package with `pip show postgres-mcp` or `pip freeze | grep -i postgres-mcp`; anything below `1.1.7` is affected\n- Check whether the server connects to Postgres with a superuser, rds_superuser or master role, since those roles make the impact worse","needs_analyst":true,"not_affected_if":["version-1.1.7-or-later"],"who_is_affected":"Teams that run the awslabs postgres-mcp-server, or a fork of it, connected to a Postgres database, especially where an AI agent passes content that an authenticated user submits into the server. Deployments on version 1.1.7 or later are not affected by this flaw, and the sources do not describe any other configuration that changes exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0008,"input_tokens":4209,"output_tokens":758,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-101':159C '-2026':2A,97C,127C,188C,448C '-85787':3A,98C,128C,189C,449C '00':172C '09':179C '09/04/2026':170C '09/08/2026':178C '1.1.7':210C,250C,259C '13':171C '2026':158C '45':180C 'access':70B 'acknowledg':455C 'actor':215C 'actual':313C 'address':256C 'agent':43B,379C 'ai':42B,45B 'ai-ag':41B 'ai-tool':44B 'allow':212C 'amazon':16A,111C,141C,202C 'applic':421C 'application-enforc':420C 'ashwak':461C 'attent':167C 'authent':237C 'authid':356C 'aw':47B,160C,162C 'aws-security@amazon.com':481C 'awslab':17A,59B,112C,142C,203C 'beyond':25A,90B,120C,150C,219C 'block':73B 'blocklist':419C,435C 'bound':441C 'boundari':322C 'bulletin':156C 'bypass':346C 'catalog':354C 'cluster':341C 'code':273C 'combin':408C 'compon':14A,57B,109C,139C,200C 'concern':487C 'connect':298C,333C,372C 'content':81B,163C,231C 'control':295C 'coordin':475C 'craft':77B,227C 'credenti':353C 'cve':1A,96C,126C,187C,447C 'data':24A,89B,119C,149C,218C 'databas':318C,415C 'database-enforc':414C 'date':169C,177C 'dedic':304C 'defens':425C 'depth':427C 'deriv':272C 'descript':183C 'disallow':8A,75B,103C,133C,194C 'disclosur':50B,477C 'email':480C 'enforc':66B,320C,416C,422C 'ensur':268C 'even':428C 'everi':74B 'fix':280C 'forc':382C 'fork':270C 'ghsa':32A,37A,451C 'ghsa-pwr4-hmph-gqgc':31A,36A,450C 'give':423C 'gqgc':35A,40A,454C 'grant':370C,394C 'hmph':34A,39A,453C 'id':157C 'identifi':186C 'impact':244C 'import':165C 'incomplet':5A,100C,130C,191C 'incorpor':277C 'input':9A,76B,104C,134C,195C 'insert/update/delete':398C 'interact':239C 'issu':253C,466C,476C 'lab':49B 'lab-disclosur':48B 'last':175C 'latest':265C 'level':349C,390C 'like':458C 'list':6A,101C,131C,192C 'map':359C 'master':342C 'mcp':20A,51B,62B,85B,115C,145C,206C,242C,284C,300C 'meant':64B 'might':211C 'minim':289C,411C 'minimal-privileg':288C,410C 'modifi':23A,88B,118C,148C,217C 'n':462C 'necessari':404C 'need':314C,380C 'new':279C 'packag':248C 'part':472C 'particular':330C 'past':433C 'patch':275C 'pdt':174C,182C 'pg':355C,357C 'place':79B,226C 'pleas':479C 'pm':173C 'postgr':19A,52B,61B,114C,144C,205C,291C,305C 'postgres-mcp-serv':18A,60B,113C,143C,204C 'privileg':290C,311C,399C,412C,439C 'process':478C 'public':168C 'pwr4':33A,38A,452C 'pypi':247C 'python':53B 'queri':431C 'question':485C 'rds':337C 'reach':327C 'read':28A,68B,93B,123C,153C,222C,352C,367C,384C 'read-on':27A,67B,92B,122C,152C,221C,366C,383C 'read/write':392C 'recommend':261C 'refer':446C 'regardless':323C 'report':464C 'requir':166C,400C 'resolut':251C 'role':292C,306C,345C,389C,413C,437C 'row':348C 'row-level':347C 'run':282C 'schema':377C,405C 'scope':30A,95B,125C,155C,161C,224C,401C 'secur':350C,484C 'select':374C 'server':21A,63B,86B,116C,146C,207C,243C,285C,301C 'session':364C 'slip':432C 'specif':397C 'sql':12A,55B,78B,107C,137C,198C,228C,326C 'still':440C 'strongest':294C 'submit':82B,234C 'superus':336C,338C 'tabl':407C 'termin':362C 'thank':460C 'tool':46B 'transact':386C 'type':164C 'unauthent':214C 'updat':176C 'upgrad':262C 'us':470C 'usag':373C 'use':302C,369C,393C 'user':238C,343C,358C 'valid':13A,56B,108C,138C,199C 'version':209C,245C,249C,258C,266C 'work':468C 'workaround':281C 'would':457C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the awslabs postgres-mcp-server, or a fork of it, connected to a Postgres database, especially where an AI agent passes content that an authenticated user submits into the server. Deployments on version 1.1.7 or later are not affected by this flaw, and the sources do not describe any other configuration that changes exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/#GHSA-pwr4-hmph-gqgc","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"AWS: CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope"}],"documents":[{"id":2886,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/","title":"AWS: CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope","kind":"advisory","source":"lab","text":"CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope\n\n### CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope\n\nBulletin ID: 2026-101-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/04/2026 13:00 PM PDT Last Updated Date: 09/08/2026 09:45 AM PDT\n\nDescription:\n\nWe have identified CVE-2026-85787, an incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server.\n\nImpacted versions: any pypi package version < 1.1.7\n\nResolution:\n\nThis issue has been addressed in version 1.1.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nRun the MCP server as a minimal-privilege Postgres role\n\nThe strongest control is to connect the MCP server using a dedicated Postgres role that has only the privileges it actually needs, so that the database itself enforces the boundary regardless of what SQL reaches it. In particular:\n\n- Do not connect as a superuser, rds_superuser, or the cluster master user. Those roles bypass row-level security, can read credential catalogs (pg_authid, pg_user_mappings), and can terminate other sessions.\n- For read-only use, grant only CONNECT + USAGE + SELECT on the schemas the agent needs, and force read-only transactions at the role level.\n- For read/write use, grant only the specific INSERT/UPDATE/DELETE privileges required, scoped to the necessary schemas and tables.\n\nCombining a minimal-privilege role (database-enforced) with the blocklist (application-enforced) gives you defense in depth: even if a query slips past the blocklist, the role's privileges still bound what it can do.\n\nReferences:\n\n- CVE-2026-85787\n- GHSA-pwr4-hmph-gqgc\n\nAcknowledgement:\n\nWe would like to thank Ashwak N for reporting this issue and working with us as part of our coordinated issue disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}