# CVE-2026-125322: pgEdge Postgres MCP Server SQL injection in count_rows

Source: https://junglewise.ai/threats/cve-2026-125322-pgedge-postgres-mcp-server-enables-sql-queries-against  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125322 · Severity: medium · CVSS 6.5 · Published 2026-11-10

pgEdge Postgres MCP Server is a tool that allows AI models and other clients to query PostgreSQL databases. Prior to version 1.1.0, attackers could inject SQL subqueries into the count_rows tool to extract sensitive data from any table in the database that their connected user role can already read—essentially turning it into a data exfiltration oracle without needing direct table access.

Technologies: [pgEdge Postgres MCP Server](https://junglewise.ai/threats/technologies/pgedge-postgres-mcp-server). Vendors: [pgEdge](https://junglewise.ai/threats/vendors/pgedge).

## Quick answers

**Is CVE-2026-125322 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125322 being exploited in the wild.

**How severe is CVE-2026-125322?** Medium severity, with a CVSS score of 6.5, published 10 November 2026.

**Which products and versions are affected?** pgEdge Postgres MCP Server before 1.1.0.

**Is there a fix for CVE-2026-125322?** Yes: fixed in 1.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125322 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-125322?** Check whether you run pgEdge Postgres MCP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.1.0

## Technical details

The count_rows tool's where parameter was concatenated directly into SQL queries without sanitization, allowing blind SQL injection through subqueries. An attacker could use boolean-blind or error-based techniques to infer data from tables not named in the tool call, bounded only by the connected role's existing SELECT privileges. Multi-statement injection was correctly blocked by the read-only query guard; the vulnerability was specifically in subquery-based inference attacks.

## Affected products

- pgEdge Postgres MCP Server before 1.1.0

## Timeline

- 2026-07-29: disclosed
- 2026-11-10: patched
- 2026-11-10: advisory

## References

- [https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314](https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314)
- [https://github.com/pgEdge/pgedge-postgres-mcp/issues/200](https://github.com/pgEdge/pgedge-postgres-mcp/issues/200)

## Related threats

- [pgEdge Postgres MCP Server write confirmation bypass in SQL classification](https://junglewise.ai/threats/cve-2026-126199-pgedge-postgres-mcp-server-enables-sql-queries-against)
- [pgEdge Postgres MCP Server SQL injection in pl-do custom tools](https://junglewise.ai/threats/cve-2026-126197-pgedge-postgres-mcp-server-enables-sql-queries-against)
- [pgEdge Postgres MCP Server read-only bypass via SQL injection](https://junglewise.ai/threats/cve-2026-126196-pgedge-postgres-mcp-server-enables-sql-queries-against)
- [pgEdge Postgres MCP Server rate limit bypass via X-Forwarded-For header spoofing](https://junglewise.ai/threats/cve-2026-125321-pgedge-postgres-mcp-server-enables-sql-queries-against)
- [pgEdge Postgres MCP Server DNS rebinding in HTTP transport](https://junglewise.ai/threats/cve-2026-125320-pgedge-postgres-mcp-server-enables-sql-queries-against)