Postgres Model Context Protocol Server Vulnerability Allows Remote Code Execution

The Regex Denylist Trap. AWS Labs postgres-mcp-server attempted to guard read-only operations via Python regex matching in mutable_sql_detector.py, blocking mutating keywords like INSERT, UPDATE, and DROP. However, Postgres includes COPY ... TO PROGRAM, which pipes query results into host shell commands. Because this operation modifies host state rather than table data, standard BEGIN READ ONLY transaction wrappers do not catch or stop it. ### Command Injection via Planted Prompts. Assigned CVE-2026-87911 with a CVSS 9.6 rating, the vulnerability allows an unauthenticated attacker to place malicious strings into external content processed by an agent. When the agent submits the generated query, the host executes arbitrary OS instructions if connecting as superuser or a member of pg_execute_server_program. RDS and Aurora environments prevent assigning this role, confining direct host exploitation to self-managed Postgres deployments. ### The Proper Four-Step Role Audit. Defense-in-depth requires enforcing least privilege in the database rather than expanding regex lists. First, query pg_has_role to check if your MCP connection role holds pg_execute_server_program. Second, update postgres-mcp-server to version 1.1.7 or later to ensure COPY_PROGRAM_PATTERN is present. Finally, explicitly strip all host-level execution roles and grant only CONNECT, USAGE, and SELECT on targeted application schemas.