CVE-2026-125321

Name of the Vulnerable Software and Affected Versions pgEdge Postgres MCP Server versions prior to 1.1.0

Description Deployments using the nondefault HTTP transport with authentication enabled incorrectly use the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. The ExtractIPAddress function in internal/auth/middleware.go passes this value to the IsAllowed() and RecordFailedAttempt() functions in internal/auth/rate limiter.go. This allows an unauthenticated user to bypass throttling by rotating addresses or to exhaust the rate limit bucket of another user by spoofing their address. This issue is facilitated by the published nginx configuration, which appends rather than replaces the X-Forwarded-For header.

Recommendations Update pgEdge Postgres MCP Server to version 1.1.0.