CVE-2026-126199: pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified querydatabase statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allowwrites connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgEdge Postgres MCP Serverto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to unconfirmed database writes?
Deployments using pgEdge Postgres MCP Server versions before 1.1.0 with an allow_writes connection are exposed. Read-only connections remain protected by PostgreSQL transaction access mode.
What must an attacker or client do to bypass the write confirmation?
They must submit a query_database statement whose first keyword causes it to be classified as a read while it performs a write. Affected patterns include SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE applied to a write.
Are all queries beginning with SELECT, WITH, or EXPLAIN affected?
No. EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. The confirmation bypass applies to the specified constructs that can perform writes despite beginning with a reading keyword.
What is the remediation?
Upgrade pgEdge Postgres MCP Server to version 1.1.0, which fixes the query classification issue. Until upgrading, use read-only connections where writes are not required, because PostgreSQL transaction access mode protects those connections from writes.