CVE-2026-85787
An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server. To remediate this issue, users should upgrade to version 1.1.7 or above.
| CWE | CWE-184 |
| Vendor | amazon |
| Product | postgres-mcp-server |
| Published | Sep 4, 2026 |
| Last Updated | Sep 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for amazon postgres-mcp-server
Be the first to know when new medium vulnerabilities affecting amazon postgres-mcp-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
Amazon / postgres-mcp-server
0 < 1.1.7