CVE-2026-85787: AWS postgres-mcp-server SQL Injection Flaw

CVE-2026-85787 Overview

CVE-2026-85787 affects the Amazon awslabs.postgres-mcp-server, a Model Context Protocol (MCP) server that brokers PostgreSQL access for AI clients. The SQL validation component maintains an incomplete list of disallowed inputs [CWE-184]. An attacker can craft SQL statements that bypass the read-only enforcement and modify data when an authenticated user submits the crafted content to the MCP server. The issue is fixed in version 1.1.7.

Critical Impact
An unauthenticated actor can smuggle write operations through content processed by an authenticated MCP session, breaking the read-only trust boundary of the postgres-mcp-server.

Affected Products

Amazon awslabs.postgres-mcp-server versions prior to 1.1.7
MCP clients and AI agents that route PostgreSQL queries through the vulnerable server
Deployments relying on the built-in read-only enforcement of the server

Discovery Timeline

2026-09-04 - CVE-2026-85787 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85787

Vulnerability Analysis

The awslabs.postgres-mcp-server exposes PostgreSQL query capabilities to MCP clients such as AI assistants. To preserve a read-only posture, the server validates incoming SQL against a denylist of disallowed statements and keywords. The list is incomplete, so certain SQL constructs evade classification as write operations and reach the database engine unmodified.

An attacker who plants crafted SQL inside content later consumed by an authenticated user (for example, in a document, ticket, or issue an AI agent summarizes) can trigger execution through that user's authenticated session. The MCP server forwards the payload under the authenticated principal, so the write executes with the user's database privileges. This makes CVE-2026-85787 an indirect prompt-injection style flaw that pivots into data modification against PostgreSQL.

Root Cause

The root cause is an incomplete denylist in the SQL validation component [CWE-184]. The validator enumerates specific disallowed inputs rather than enforcing a positive, allowlist-based model that permits only known read-only constructs such as SELECT, EXPLAIN, or SHOW. Statement variants, syntactic alternatives, and composite constructs are not classified as mutating operations and pass validation.

Attack Vector

Exploitation requires an authenticated MCP session to the vulnerable server and user interaction that submits attacker-controlled content. The attacker does not need direct credentials to the database or the MCP server. The attacker places crafted SQL into content the victim processes through the MCP workflow. When the authenticated user interacts with that content, the client forwards the payload to the postgres-mcp-server, the validator misclassifies it as read-only, and PostgreSQL executes the write.

No verified proof-of-concept code is published for this issue. See the AWS Security Bulletin 2026-101 for vendor technical details.

Detection Methods for CVE-2026-85787

Indicators of Compromise

PostgreSQL audit log entries showing INSERT, UPDATE, DELETE, DROP, or ALTER statements originating from sessions labeled as read-only MCP connections.
Unexpected schema or row changes correlated in time with MCP client activity from AI assistants or automation.
Requests to the postgres-mcp-server containing SQL keywords that should have been rejected by the validator.

Detection Strategies

Enable pgaudit or PostgreSQL statement logging and alert on any write-class statement executed by database roles reserved for the MCP server.
Instrument the MCP server host to log the raw SQL forwarded to PostgreSQL and compare it against the intended read-only surface.
Review MCP client transcripts and ingested content for embedded SQL fragments that resemble injection payloads.

Monitoring Recommendations

Track the installed version of awslabs.postgres-mcp-server across hosts and flag any instance below 1.1.7.
Monitor outbound traffic from AI agent hosts to database endpoints for anomalous statement patterns or volumes.
Correlate PostgreSQL write events with the identity of the MCP-authenticated user to detect misuse under legitimate sessions.

How to Mitigate CVE-2026-85787

Immediate Actions Required

Upgrade awslabs.postgres-mcp-server to version 1.1.7 or later on all hosts that expose PostgreSQL through MCP.
Restrict the database role used by the MCP server to SELECT-only privileges on the target schemas so bypassed validation cannot escalate to writes.
Audit PostgreSQL logs since deployment of the vulnerable server for unauthorized write activity from MCP-associated roles.

Patch Information

Amazon released the fix in awslabs.postgres-mcp-server1.1.7, available on the PyPI project page. Refer to the AWS Security Bulletin 2026-101 for the vendor advisory.

Workarounds

Enforce read-only permissions at the PostgreSQL role level rather than trusting server-side SQL validation.
Place the MCP server behind a database proxy that permits only an allowlist of read-only statement shapes.
Constrain which MCP clients and users can invoke the postgres-mcp-server and require review of ingested content that may contain untrusted SQL.

bash

# Upgrade the vulnerable package to the patched release
pip install --upgrade 'awslabs.postgres-mcp-server>=1.1.7'

# Verify the installed version
pip show awslabs.postgres-mcp-server | grep -i version

# Enforce a read-only PostgreSQL role for the MCP server
psql -c "REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ALL TABLES IN SCHEMA public FROM mcp_reader;"
psql -c "GRANT SELECT ON ALL TABLES IN SCHEMA public TO mcp_reader;"