CVE-2026-126196

A read-only MCP query could write using the database role’s privileges

pgEdge · Postgres MCP Server read-only connections

First documented disclosure · Review checkpoint

Summary

The gateway failed to enforce read-only transaction settings across an entire database request. Database content or availability could be affected, including through pooled session state.

Severity and exploitation evidence

High · 8.1/10 · CVSS 3.1. Severity source.

Exploitation not established: pgEdge engineering demonstrated the issue against a disposable database. The reviewed sources identify no malicious activity.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The gateway failed to enforce read-only transaction settings across an entire database request.

Conditions required

The caller could issue queries and the underlying PostgreSQL role had write privileges.

Potential impact

Database content or availability could be affected, including through pooled session state.

Affected versions and configurations

Before 1.1.0.

Fix and mitigation status

1.1.0.

Practical next steps

Upgrade to 1.1.0 or later and give read-only connections a PostgreSQL role without write privileges.

Operating lesson

Enforce read-only access independently in the database.

Evidence and limits

The pgEdge advisory distinguishes database writes from the reads that this connection already allowed. The public fix discussion described this issue on 2026-07-28. The formal advisory followed on 2026-09-03, and the CVE record on 2026-11-12.

Sources