CVE-2026-125320

A browser could reach a local Postgres MCP server through its HTTP transport

pgEdge · Postgres MCP Server HTTP transport

First documented disclosure · Review checkpoint

Summary

The HTTP listener accepted cross-origin requests without checking their origin. The site could read schemas and query results visible to the server’s configured database account.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The HTTP listener accepted cross-origin requests without checking their origin.

Conditions required

The nondefault HTTP transport ran on a machine whose user visited an untrusted website.

Potential impact

The site could read schemas and query results visible to the server’s configured database account.

Affected versions and configurations

Before 1.1.0 with HTTP transport enabled. Default stdio deployments were outside this path.

Fix and mitigation status

1.1.0.

Practical next steps

Upgrade the MCP server or use its default stdio transport.

Operating lesson

Give AI retrieval and tool services database credentials scoped to the data they need.

Evidence and limits

The public disclosure was on 2026-09-03. The CVE record was published on 2026-11-10.

Sources