CVE-2026-87911

Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

Assigner: AMZN
Reserved: 09.09.2026 Published: 09.09.2026 Updated: 09.09.2026

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode.

To remediate this issue, users should upgrade to version 1.1.7 or later.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS Score: 9.6

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	Present	Availability	High	Availability	High
Privileges Required	None
User Interaction	Passive

CVSS 4.0

Product Status

Vendor	AWS
Product	AWS Labs postgres MCP Server
Versions	Default: unaffected affected from 0 to 1.1.7 (excl.)

Vendor

AWS

Product

AWS Labs postgres MCP Server

Versions

Default: unaffected

affected from 0 to 1.1.7 (excl.)

Credits

Corsen AI finder

References

Problem Types

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') CWE
CWE-184 Incomplete list of disallowed inputs CWE

Impacts

CAPEC-248 Command Injection
CAPEC-153 Input Data Manipulation