{"id":"CVE-2026-126197","summary":"pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters","details":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0.","aliases":["GHSA-r5pp-jx86-r6r9"],"modified":"2026-11-13T02:47:05.942851449Z","published":"2026-11-12T17:29:35.883Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126197.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-89"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126197.json"},{"type":"FIX","url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"},{"type":"FIX","url":"https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"},{"type":"ADVISORY","url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126197"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pgedge/pgedge-postgres-mcp","events":[{"introduced":"0"},{"fixed":"25c2aaed03398584ceea0dd71f7f67631c3dff4e"},{"fixed":"b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"1.1.0"}]},{"range":[{"fixed":"b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v1.1.0","range":[{"fixed":"25c2aaed03398584ceea0dd71f7f67631c3dff4e"}]}]}}],"versions":["kb-2026-04-27","kb-2026-04-22","v1.0.0","v1.0.0-beta3a","v1.0.0-beta3","v1.0.0-beta1","v1.0.0-alpha6","v1.0.0-alpha5","v1.0.0-alpha4","v1.0.0-alpha3","v1.0.0-alpha2","v1.0.0-alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126197.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}