CVE-2026-126198: pgEdge Postgres MCP Server custom tools performed writes without user confirmation
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the querydatabase tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allowwrites connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgEdge Postgres MCP Serverto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to unconfirmed database writes?
Deployments using pgEdge Postgres MCP Server before 1.1.0 with its bundled CLI or web client are affected when they use an allow_writes connection and expose custom pl-do, pl-func, or writing sql tools. Other MCP clients do not inherit the bundled clients' confirmation behavior.
What must happen for an attacker to cause a write?
A write-capable custom tool must be available through an allow_writes connection, and the bundled client must invoke it. The issue can be triggered when a model follows instructions contained in retrieved content, because the client did not request confirmation for those custom writing tools.
Does the missing confirmation mean the server bypasses database authorization?
No. The affected control is a warning and confirmation mechanism in bundled clients, not a server-side authorization boundary. Database access remains governed by the permissions available to the configured connection.
What is the remediation?
Upgrade pgEdge Postgres MCP Server to version 1.1.0, which fixes the bundled clients' handling of server-published write annotations.