Skip to main content

CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

Bulletin ID: 2026-104-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 09/09/2026 12:30 PM PDT

Description:

awslabs.postgres-mcp-server is a python package that implements a Postgres MCP server. We found CVE-2026-87911, where an OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode.

Impacted versions:

awslabs.postgres-mcp-server before 1.1.7, self-managed PostgreSQL deployment profile (PG_WIRE_PROTOCOL connection method) where the configured database role holds superuser or pg_execute_server_program.

Resolution:

This issue has been addressed in awslabs postgres-mcp-server (python package) version 1.1.7 in pypi.

Workarounds:

The strongest control is to connect the MCP server using a dedicated Postgres role that has only the privileges it actually needs, so that the database itself enforces the boundary regardless of what SQL reaches it. In particular:

  • Do not connect as a superuser, rds_superuser, or the cluster master user. Those roles bypass row-level security, can read credential catalogs (pg_authid, pg_user_mappings), and can terminate other sessions.
  • For read-only use, grant only CONNECT + USAGE + SELECT on the schemas the agent needs, and force read-only transactions at the role level.
  • For read/write use, grant only the specific INSERT/UPDATE/DELETE privileges required, scoped to the necessary schemas and tables.

Combining a minimal-privilege role (database-enforced) with the blocklist (application-enforced) gives you defense in depth: even if a query slips past the blocklist, the role's privileges still bound what it can do.

References:

Acknowledgement:

We would like to thank Mordehai Attia (Corsen AI) and Ryan von Brubeck for collaborating on this issue through the coordinated vulnerability disclosure process.


Please email aws-security@amazon.com with any security questions or concerns.