SEPTEMBER 14, 2026
Live Feed
Back to database
Case File

CVE-2026-87911

CRITICAL · CVSS 9.6 EPSS 0.99% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-09 · Last synced 2026-09-14

CyberRota Analysis

AI-Generated

A critical OS command injection vulnerability exists in the SQL validation component of Amazon awslabs postgres-mcp-server prior to version 1.1.7, allowing unauthenticated attackers to execute arbitrary operating system commands on self-managed PostgreSQL servers. This risk is particularly concerning for organizations using this component in a default read-only mode, as it can be exploited through manipulated COPY ... TO PROGRAM statements. Users should prioritize upgrading to version 1.1.7 or later to mitigate this severe threat.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-87911
Severity
CRITICAL
CVSS
9.6
EPSS
0.99%

Original NVD Description

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode. To remediate this issue, users should upgrade to version 1.1.7 or later.