CVE-2026-125321
pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. ExtractIPAddress in internal/auth/middleware.go supplied that value to IsAllowed and RecordFailedAttempt in internal/auth/rate_limiter.go, allowing an unauthenticated caller to rotate addresses to evade throttling or assert another user's address to consume that user's limiter bucket. The published nginx configuration appended rather than replaced X-Forwarded-For, making the issue reachable without an operator misconfiguration. Username-keyed account lockout did not use the client address, but shipped defaults disabled that separate control through MaxFailedAttemptsBeforeLockout: 0. This issue is fixed in version 1.1.0.
| CWE | CWE-770 CWE-807 |
| Vendor | pgedge |
| Product | pgedge-postgres-mcp |
| Published | Nov 10, 2026 |
| Last Updated | Nov 10, 2026 |
Get instant alerts for pgedge pgedge-postgres-mcp
Be the first to know when new medium vulnerabilities affecting pgedge pgedge-postgres-mcp are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L