postgres-mcp-server CVE-2026-85787

Exploitation requires two sequential conditions: first, the attacker must be able to pre-position crafted SQL content in a source that the postgres-mcp-server will later read and process (e.g., a database table, a tool-response payload, or any input channel feeding the MCP server); second, an authenticated user must trigger an MCP interaction that causes the server to process that attacker-controlled content. The attacker themselves requires no credentials or privileges against the MCP server - only the ability to write to a data source it consumes. Deployments where all data sources are strictly controlled and isolated from external write access significantly reduce exploitability. The read-only enforcement bypass applies specifically to the SQL validation denylist component in versions prior to 1.1.7.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N) scores 7.1, reflecting network-reachable exploitation with no attacker privileges required but mandatory authenticated-user interaction. Real-world exploitability depends on whether an attacker can pre-position crafted SQL content in sources consumed by the MCP server before a legitimate user triggers a query - a condition that adds meaningful friction relative to a direct injection flaw. No EPSS data was provided and the CVE is not listed in CISA KEV, suggesting no confirmed active exploitation. The integrity-only impact (VI:H, C:N/A:N) means the blast radius is data modification rather than exfiltration or system compromise, which limits but does not eliminate urgency. Risk is elevated for deployments where the MCP server operates over external or untrusted data sources, and reduced in tightly controlled single-tenant environments. The 'Information Disclosure' tag in the input metadata is incorrect given the C:N/VI:H vector - this is an integrity violation, not a confidentiality breach.

An attacker places a crafted SQL statement - one that bypasses the incomplete denylist, such as a DELETE or UPDATE command disguised through comment injection or less-common SQL syntax - into a database column or tool-response payload accessible to the MCP server. When a legitimate authenticated user subsequently issues a natural-language query that causes the MCP server to fetch and process that content, the crafted SQL executes against the PostgreSQL backend, modifying data outside the intended read-only scope. No public exploit code has been identified at time of analysis.