CVE-2026-125322: pgEdge Postgres MCP Server SQL injection in the count_rows where parameter
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the countrows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgEdge Postgres MCP Serverto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
Which deployments are exposed?
pgEdge Postgres MCP Server versions prior to 1.1.0 are affected when the count_rows tool is available. Exposure is limited to data readable by the database role used by the server connection.
What does an attacker need to exploit this issue?
The attacker needs the ability to call the count_rows tool and supply its where parameter. They can use predicates containing subqueries and infer data from returned row counts.
Does this bypass PostgreSQL permissions?
No. The issue does not grant access beyond the connected database role's existing SELECT privileges; PostgreSQL's database privilege boundary remains intact.
How can this be remediated?
Upgrade pgEdge Postgres MCP Server to version 1.1.0, which fixes the issue.