AWS repairs a Postgres MCP server bug that let SQL change data
The SQL check did not stop all bad inputs, and version 1.1.7 repairs this.
On 4 September 2026, AWS gave notice of bug CVE-2026-85787 in its Postgres MCP server before version 1.1.7. The SQL check did not have all bad inputs in its set. AWS reports that an actor with no login can change data in a read-only MCP server, with made SQL in content that a user sends.
How it works
The MCP server (a connection between an AI agent and a database) stops some SQL inputs. The set of those inputs was not full. SQL made by the attacker could then go through.
The fix
Install version 1.1.7. AWS reports that the primary control is a dedicated Postgres role with minimum privileges.
- Do not use a superuser,
rds_superuseror the cluster master user. - For read-only use, give only
CONNECT,USAGEandSELECT. - For read and write use, give only the
INSERT,UPDATEorDELETEprivileges that you must have.
What is not known
The notice gives no number of users with the bug. It gives no sign that attackers use the bug.
Insight: A check in the tool breaks, but a database role holds
The CoreBreak bug let an attacker make an agent operate a tool with no check by the model. This notice shows that a check in the tool can break too. Each check on input can break, and only the role in the database keeps its limit, as AWS reports. Find out which role your agents use.
Sources
- CVE-2026-85787An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope
Posted
