CVE-2026-126199

The bundled pgEdge clients could mistake a writing query for a read

pgEdge · Postgres MCP Server SQL write confirmation

First documented disclosure · Review checkpoint

Summary

The standard query tool classified statements using only their opening keyword. Some database writes could proceed without the confirmation prompt.

Severity and exploitation evidence

Medium · 6.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The standard query tool classified statements using only their opening keyword.

Conditions required

The bundled CLI or web client used a write-enabled connection.

Potential impact

Some database writes could proceed without the confirmation prompt.

Affected versions and configurations

Before 1.1.0.

Fix and mitigation status

1.1.0.

Practical next steps

Upgrade bundled clients to 1.1.0 or later. Use a read-only database role for clients that only need reads.

Operating lesson

Determine a query’s effects before requesting approval.

Evidence and limits

This affects classification within the built-in query tool. CVE-2026-126198 concerns custom-tool annotations. The public fix discussion described this issue on 2026-08-06. The formal advisory followed on 2026-11-11, and the CVE record on 2026-11-12.

Sources