CVE-2026-126197

Name of the Vulnerable Software and Affected Versions pgEdge Postgres MCP Server versions prior to 1.1.0

Description Custom pl-do tools interpolate JSON arguments into a PostgreSQL DO block using fixed dollar-quote tags. An attacker can provide an argument containing $mcp custom tool$ to terminate the block and inject arbitrary SQL statements, or use $mcp args$ to inject procedural code into a plpgsql block. Since the simple query protocol is used, the injected text can include additional statements and transaction control, allowing the bypass of read only restrictions to access data or modify resources available to the connecting role. This issue specifically affects the pl-do custom tool; the sql and pl-func tools are not affected as they use bind parameters.

Recommendations Update pgEdge Postgres MCP Server to version 1.1.0. As a temporary mitigation, disable the use of pl-do custom tools.