CVE-2026-126196: pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, querydatabase on a readonly connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on readonly as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgEdge Postgres MCP Serverto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to write operations?
Deployments prior to 1.1.0 that rely on a read_only connection as a safety boundary are affected if the database role used by that connection has write privileges. The issue can compromise integrity and availability, but does not expand confidentiality beyond data the connection can already read.
What does an attacker need to exploit this issue?
An attacker needs the ability to invoke query_database through an MCP-compatible client against a read_only connection. They can submit an unrecognized SQL statement without bind parameters and include multiple semicolon-separated statements to alter transaction or session state and perform writes.
Why can the impact persist beyond a single request?
The vulnerable behavior can change session state on a pooled database connection. That state may leave the pooled session writable for subsequent calls.
What is the available remediation?
Upgrade pgEdge Postgres MCP Server to version 1.1.0, which fixes the issue. Until upgrading, do not rely on read_only alone to prevent writes; use a connecting database role that lacks write privileges.