CVE-2026-87911 Overview
CVE-2026-87911 is an operating system (OS) command injection vulnerability [CWE-78] in the Amazon awslabs postgres-mcp-server, a Model Context Protocol (MCP) server for PostgreSQL. The flaw resides in the read-only enforcement logic of the SQL validation component in versions prior to 1.1.7. An unauthenticated attacker can smuggle a crafted COPY ... TO PROGRAM statement into content processed by the MCP server. When an authenticated user interacts with the server, even in its default read-only mode, the statement executes on the host of a self-managed PostgreSQL server. Amazon has released version 1.1.7 to remediate the issue.
Critical Impact
Unauthenticated attackers can achieve OS command execution on self-managed PostgreSQL hosts through prompt content processed by an authenticated MCP user.
Affected Products
- Amazon awslabs.postgres-mcp-server versions before 1.1.7
- Self-managed PostgreSQL deployments connected through the vulnerable MCP server
- MCP client environments processing untrusted content through the postgres-mcp-server
Discovery Timeline
- 2026-09-09 - CVE-2026-87911 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87911
Vulnerability Analysis
The awslabs.postgres-mcp-server exposes PostgreSQL to Model Context Protocol clients and enforces a default read-only mode by validating SQL statements before dispatch. The validation component fails to block PostgreSQL's COPY ... TO PROGRAM statement, which instructs the database server to spawn a shell command and pipe query results to it. When an attacker plants a crafted statement in content later consumed by the MCP server, the statement bypasses read-only checks and reaches the backend. The PostgreSQL server then executes the embedded command under the account running the database process. The attack requires no authentication against the attacker-facing surface because the malicious payload rides on content an authenticated user submits.
Root Cause
The SQL validation logic classifies statements as read-only based on incomplete parsing rules that do not recognize COPY ... TO PROGRAM as a side-effect-producing operation. PostgreSQL treats COPY TO PROGRAM as a superuser-invocable command that shells out to the operating system. Because the guard rail treats the statement as a benign data-export operation, the injected command executes without restriction [CWE-78].
Attack Vector
Exploitation occurs through indirect prompt injection. An attacker plants a COPY ... TO PROGRAM 'command' statement into any content source that the MCP server later processes on behalf of an authenticated user, such as a document, ticket, or database record. When the authenticated user interacts with the MCP server, the server forwards the crafted SQL to the PostgreSQL backend. The backend executes the command on the host, resulting in remote code execution with the privileges of the PostgreSQL service account. Refer to the GitHub Security Advisory GHSA-fph8-pg5w-78fv for additional technical detail.
Detection Methods for CVE-2026-87911
Indicators of Compromise
- PostgreSQL server logs containing COPY statements with the TO PROGRAM clause originating from MCP sessions
- Unexpected child processes spawned by the postgres backend process, such as shells, curl, wget, or scripting interpreters
- Outbound network connections initiated by the PostgreSQL service account to unfamiliar destinations
- New or modified files in the PostgreSQL data directory or home directory of the database service account
Detection Strategies
- Enable PostgreSQL log_statement = 'all' on affected hosts and alert on any statement containing TO PROGRAM or FROM PROGRAM
- Correlate MCP server access logs with PostgreSQL query logs to identify statements introduced through prompt content
- Monitor process ancestry to flag any non-database executable whose parent is postgres
Monitoring Recommendations
- Track invocations of the awslabs.postgres-mcp-server binary and record the running version to identify hosts still on vulnerable releases
- Ingest PostgreSQL and MCP telemetry into a centralized analytics platform to enable cross-source correlation
- Baseline outbound network traffic from database hosts and alert on deviations tied to the postgres user
How to Mitigate CVE-2026-87911
Immediate Actions Required
- Upgrade awslabs.postgres-mcp-server to version 1.1.7 or later from the PyPI package release
- Audit PostgreSQL query logs for historical COPY ... TO PROGRAM statements originating from MCP sessions
- Rotate credentials for the PostgreSQL service account and any secrets accessible from the database host
- Review MCP server input sources for planted payloads in stored content
Patch Information
Amazon released awslabs.postgres-mcp-server version 1.1.7, which corrects the SQL validation logic so that COPY ... TO PROGRAM statements are rejected in read-only mode. See the AWS Security Bulletin 2026-104 for the official vendor advisory.
Workarounds
- Run the PostgreSQL backend under a non-superuser role, because COPY TO PROGRAM requires superuser or pg_execute_server_program membership
- Restrict the MCP server's database role to the minimum privileges needed and remove pg_execute_server_program membership
- Isolate self-managed PostgreSQL hosts on segmented networks and block outbound egress from the database service account
- Sanitize or filter untrusted content before it is processed by the MCP server
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
