CVE-2026-87911: Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode.
To remediate this issue, users should upgrade to version 1.1.7 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon awslabs postgres-mcp-serverto a version that resolves this vulnerability.Fixed in 1.1.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Self-managed PostgreSQL server hosts running Amazon awslabs postgres-mcp-server before version 1.1.7 are exposed when the MCP server processes attacker-controlled content during an authenticated user's interaction. The affected mode is the default read-only mode.
Does an attacker need credentials or direct database access?
The actor is described as unauthenticated, but exploitation requires them to place a crafted COPY ... TO PROGRAM statement into content that is later processed when an authenticated user interacts with the MCP server. No direct database access requirement is stated.
What can happen if exploitation succeeds?
An attacker may execute operating system commands on the host running the self-managed PostgreSQL server. The reported impact includes high confidentiality, integrity, and availability effects.
What should teams do if they are affected?
Upgrade Amazon awslabs postgres-mcp-server to version 1.1.7 or later. The provided data does not specify an alternative mitigation for environments that cannot immediately upgrade.