# CVE-2026-126197: pgEdge Postgres MCP Server SQL injection in pl-do custom tools

Source: https://junglewise.ai/threats/cve-2026-126197-pgedge-postgres-mcp-server-enables-sql-queries-against  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126197 · Severity: high · CVSS 8.8 · Published 2026-11-12

pgEdge Postgres MCP Server is a tool that allows AI model clients to execute SQL queries against PostgreSQL databases. Before version 1.1.0, an attacker could inject arbitrary SQL statements by including special characters in query arguments, potentially reading sensitive data or modifying the database even when the connection was supposed to be read-only. This could allow an attacker with access to an MCP client to bypass security restrictions and compromise the connected database.

Technologies: [pgEdge Postgres MCP Server](https://junglewise.ai/threats/technologies/pgedge-postgres-mcp-server). Vendors: [pgEdge](https://junglewise.ai/threats/vendors/pgedge).

## Quick answers

**Is CVE-2026-126197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126197 being exploited in the wild.

**How severe is CVE-2026-126197?** High severity, with a CVSS score of 8.8, published 12 November 2026.

**Which products and versions are affected?** pgEdge Postgres MCP Server before 1.1.0.

**Is there a fix for CVE-2026-126197?** Yes: fixed in 1.1.0. Until then: Disable pl-do custom tools if they are not required for your use case, as only pl-do tools are vulnerable; sql and pl-func tools are not affected by this injection mechanism. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126197 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126197?** Check whether you run pgEdge Postgres MCP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.1.0

Disable pl-do custom tools if they are not required for your use case, as only pl-do tools are vulnerable; sql and pl-func tools are not affected by this injection mechanism.

## Technical details

The vulnerability exists in custom pl-do tools that interpolate JSON arguments into PostgreSQL DO blocks using fixed dollar-quote delimiters. An attacker can inject $mcp_custom_tool$ or $mcp_args$ strings to terminate the block and inject arbitrary SQL statements. Because these statements use PostgreSQL's simple query protocol, they can include additional statements and transaction control commands, bypassing read_only restrictions. The vulnerability requires at least one pl-do custom tool to be configured; sql and pl-func tools use bind parameters and are not affected.

## Affected products

- pgEdge Postgres MCP Server before 1.1.0

## Timeline

- 2026-11-12: disclosed

## References

- [https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868](https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868)
- [https://github.com/pgEdge/pgedge-postgres-mcp/pull/196](https://github.com/pgEdge/pgedge-postgres-mcp/pull/196)

## Related threats

- [pgEdge Postgres MCP Server write confirmation bypass in SQL classification](https://junglewise.ai/threats/cve-2026-126199-pgedge-postgres-mcp-server-enables-sql-queries-against)
- [pgEdge Postgres MCP Server read-only bypass via SQL injection](https://junglewise.ai/threats/cve-2026-126196-pgedge-postgres-mcp-server-enables-sql-queries-against)
- [pgEdge Postgres MCP Server SQL injection in count_rows](https://junglewise.ai/threats/cve-2026-125322-pgedge-postgres-mcp-server-enables-sql-queries-against)
- [pgEdge Postgres MCP Server rate limit bypass via X-Forwarded-For header spoofing](https://junglewise.ai/threats/cve-2026-125321-pgedge-postgres-mcp-server-enables-sql-queries-against)
- [pgEdge Postgres MCP Server DNS rebinding in HTTP transport](https://junglewise.ai/threats/cve-2026-125320-pgedge-postgres-mcp-server-enables-sql-queries-against)