CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope

The vulnerability CVE-2026-85787 affects the SQL validation component of Amazon awslabs postgres-mcp-server versions before 1.1.7. Due to an incomplete blocklist of disallowed SQL inputs, an unauthenticated attacker can inject crafted SQL through content submitted by an authenticated user, potentially modifying data beyond the intended read-only scope. The flaw is addressed in version 1.1.7. Additional mitigation involves running the MCP server with a dedicated Postgres role with minimal privileges, restricting database access to only necessary operations and schemas, thereby enforcing access control at the database level and providing defense in depth.

An unauthenticated actor can exploit this vulnerability to modify data beyond the intended read-only scope by injecting crafted SQL through content submitted by an authenticated user. This could lead to unauthorized data modification within the database managed by the MCP server. The impact is limited to versions prior to 1.1.7 and depends on the privileges of the Postgres role used by the MCP server.

A fix is available in version 1.1.7 of the Amazon awslabs postgres-mcp-server. It is recommended to upgrade to version 1.1.7 or later. Additionally, running the MCP server with a minimal-privilege Postgres role is advised to enforce database-level access controls. This includes avoiding superuser or cluster master roles and granting only the necessary privileges scoped to required schemas and tables. Combining the application-level blocklist with database-enforced minimal privileges provides defense in depth.