CVE-2026-126198

The bundled pgEdge clients could run custom write tools without confirmation

pgEdge · Postgres MCP Server custom write confirmation

First documented disclosure · Review checkpoint

Summary

The CLI and web client recognized the standard database tool name but ignored custom tools’ write annotations. A write could occur before the user approved it, including when instructions came from retrieved content.

Severity and exploitation evidence

Low · 3.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The CLI and web client recognized the standard database tool name but ignored custom tools’ write annotations.

Conditions required

The bundled client used a write-enabled connection and invoked a custom tool that altered data.

Potential impact

A write could occur before the user approved it, including when instructions came from retrieved content.

Affected versions and configurations

Before 1.1.0.

Fix and mitigation status

1.1.0.

Practical next steps

Upgrade the bundled clients to 1.1.0 or later and limit the database role’s write privileges.

Operating lesson

Base confirmation on the operation a tool performs.

Evidence and limits

This concerns a client confirmation prompt on a write-enabled connection. Other MCP clients implement their own approval behavior. The public fix discussion described this issue on 2026-07-28. The formal advisory followed on 2026-09-03, and the CVE record on 2026-11-12.

Sources