pgEdge Postgres MCP Server: SQL injection in count_rows where parameter
Summary
The count_rows tool of pgEdge Postgres MCP Server accepted subqueries in its where parameter, which could reference tables other than the one named in the call. An authenticated caller can use the returned row count as a true/false signal to infer data from any table that the connected database role can read. The database privileges of that role remain the limit, and the flaw does not grant additional table access.
Affected
- pgEdge pgedge-postgres-mcp, all versions prior to 1.1.0
Fixed in
- Version 1.1.0 (fix in PR #201, commit 933f1b4)
Workaround
- Disable the count_rows tool via builtins.tools.count_rows or PGEDGE_BUILTIN_TOOL_COUNT_ROWS
- Restrict the database role to only the tables the assistant needs (general least-privilege practice, not vendor guidance)
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- A third-party tracker lists it as not known to be exploited.
Our recommendation
- Upgrade to pgEdge Postgres MCP Server 1.1.0 (use the GA release, not a pre-release) at the next maintenance window, sooner if the server is network-exposed or holds sensitive data.
- Review which database roles the MCP server uses and remove SELECT rights on sensitive tables that the assistant does not need.
- Check whether the MCP endpoint is reachable beyond trusted users.
- Patch CVE-2026-125321 at the same time, as it affects the HTTP transport with authentication enabled.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fhv3-x3jh-grj7 github.com
- Fix commit 933f1b4 github.com
- Issue #200 github.com
- Pull request #201 github.com
- Release v1.1.0 github.com
- Tools reference documentation docs.pgedge.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:41.
Original description (NVD)
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0.
NVD references (5)
- https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314
- https://github.com/pgEdge/pgedge-postgres-mcp/issues/200
- https://github.com/pgEdge/pgedge-postgres-mcp/pull/201
- https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0
- https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.