Executive brief
Amazon's postgres-mcp-server is a tool that provides SQL database access with read-only restrictions. A flaw in its SQL input validation allows unauthenticated attackers to bypass these read-only protections and modify database data by injecting crafted SQL commands, potentially compromising data integrity and confidentiality for any system using this tool.
Technical details
The vulnerability is an SQL injection weakness caused by an incomplete list of disallowed inputs in the SQL validation component of postgres-mcp-server. An unauthenticated actor can craft malicious SQL and submit it when an authenticated user interacts with the MCP server, allowing data modification operations that should be restricted to read-only access. The attack requires an authenticated user to be actively using the server, but the attacker themselves does not need authentication. The flaw affects all versions before 1.1.7 and is fixed in version 1.1.7 or later. This represents a privilege escalation and data integrity violation within the intended security model of the read-only restriction.
Affected products
- Amazon postgres-mcp-server before 1.1.7
Timeline
- 2026-09-04: disclosed: AWS Security Bulletin 2026-101-AWS published
- 2026-09-04: patched: Fix available in version 1.1.7 or later