---
id: "GHSA-pwr4-hmph-gqgc"
kind: "vulnerability"
aliases: ["GHSA-pwr4-hmph-gqgc"]
title: "CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "aws", "lab-disclosure", "mcp", "postgres", "python"]
not_affected_if: ["version-1.1.7-or-later"]
published_at: null
first_seen_at: "2026-10-24T18:43:45+00:00"
updated_at: "2026-10-25T04:51:42+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/", "first_seen_at": "2026-10-24T18:43:45+00:00"}]
---

# CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope

The SQL validation component in awslabs postgres-mcp-server, meant to enforce read-only access, does not block every disallowed input. Crafted SQL placed in content submitted to the MCP server can modify data beyond the read-only scope.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the awslabs postgres-mcp-server package with `pip show postgres-mcp` or `pip freeze | grep -i postgres-mcp`; anything below `1.1.7` is affected
- Check whether the server connects to Postgres with a superuser, rds_superuser or master role, since those roles make the impact worse

## Fix

- Upgrade the awslabs postgres-mcp-server PyPI package to `1.1.7` or later
- Patch any forked or derivative copies of the server to include the fix
- Connect the MCP server with a dedicated minimal-privilege Postgres role, granting only the SELECT (or specific INSERT/UPDATE/DELETE) privileges it needs

## Timeline

- 2026-10-24T18:43:45+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/ — AWS: CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope

## Documents

- [advisory] AWS: CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws/

## From the sources

CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope

### CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope

Bulletin ID: 2026-101-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/04/2026 13:00 PM PDT Last Updated Date: 09/08/2026 09:45 AM PDT

Description:

We have identified CVE-2026-85787, an incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server.

Impacted versions: any pypi package version < 1.1.7

Resolution:

This issue has been addressed in version 1.1.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

Run the MCP server as a minimal-privilege Postgres role

The strongest control is to connect the MCP server using a dedicated Postgres role that has only the privileges it actually needs, so that the database itself enforces the boundary regardless of what SQL reaches it. In particular:

- Do not connect as a superuser, rds_superuser, or the cluster master user. Those roles bypass row-level security, can read credential catalogs (pg_authid, pg_user_mappings), and can terminate other sessions.
- For read-only use, grant only CONNECT + USAGE + SELECT on the schemas the agent needs, and force read-only transactions at the role level.
- For read/write use, grant only the specific INSERT/UPDATE/DELETE privileges required, scoped to the necessary schemas and tables.

Combining a minimal-privilege role (database-enforced) with the blocklist (application-enforced) gives you defense in depth: even if a query slips past the blocklist, the role's privileges still bound what it can do.

References:

- CVE-2026-85787
- GHSA-pwr4-hmph-gqgc

Acknowledgement:

We would like to thank Ashwak N for reporting this issue and working with us as part of our coordinated issue disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_