Executive brief
Amazon's postgres-mcp-server is a Python tool that enables AI agents to query PostgreSQL databases via the Model Context Protocol. A flaw in the read-only mode's SQL validation allows an unauthenticated attacker to execute arbitrary operating system commands on the PostgreSQL host by injecting a crafted COPY...TO PROGRAM SQL statement when an authenticated user interacts with the server. This grants attackers full control over the server running the database, enabling data theft, system compromise, and service disruption.
Technical details
The vulnerability is an OS command injection (CWE-78) combined with incomplete input validation (CWE-184) in the SQL validation component of postgres-mcp-server. The root cause is an incomplete blocklist that fails to filter the COPY...TO PROGRAM PostgreSQL syntax, which executes OS commands on the database host. The attack requires network access to the MCP server, user interaction (an authenticated user must interact with the server while the malicious content is present), and the PostgreSQL connection to use a role with superuser or pg_execute_server_program privileges. Affected versions are before 1.1.7. The exploit allows arbitrary OS command execution in the database host's security context. The patch is available in version 1.1.7 on PyPI; users are also advised to apply database-level controls by connecting with minimal-privilege roles.
Affected products
- Amazon postgres-mcp-server < 1.1.7
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: version 1.1.7 released