CVE-2026-126197

A custom pgEdge MCP tool could interpret arguments as database code

pgEdge · Postgres MCP Server custom procedural tools

First documented disclosure · Review checkpoint

Summary

Custom procedural tools inserted argument text into the database code they executed. The caller could read or modify data within the database role’s privileges.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Custom procedural tools inserted argument text into the database code they executed.

Conditions required

At least one custom pl-do tool was configured and callable.

Potential impact

The caller could read or modify data within the database role’s privileges.

Affected versions and configurations

Before 1.1.0.

Fix and mitigation status

1.1.0.

Practical next steps

Upgrade to 1.1.0 or later and restrict privileges of roles used by procedural tools.

Operating lesson

Keep tool parameters separate from executable SQL.

Evidence and limits

The maintainer limits this injection mechanism to pl-do tools. It distinguishes sql and pl-func tools that bind arguments. The public fix discussion described this issue on 2026-07-28. The formal advisory followed on 2026-11-11, and the CVE record on 2026-11-12.

Sources