SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-85787

MEDIUM · CVSS 6.5 EPSS 0.20%

Source: NVD + CISA KEV + EPSS · Published 2026-09-04 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The SQL validation component in Amazon awslabs postgres-mcp-server prior to version 1.1.7 is vulnerable to unauthorized data modification due to an incomplete list of disallowed inputs. This flaw could allow unauthenticated attackers to execute crafted SQL queries, potentially compromising data integrity. Organizations using this server should prioritize upgrading to version 1.1.7 or later to mitigate the risk.

CVE
CVE-2026-85787
Severity
MEDIUM
CVSS
6.5
EPSS
0.20%

Original NVD Description

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server. To remediate this issue, users should upgrade to version 1.1.7 or above.