CVE-2026-87911
A critical vulnerability in Amazon awslabs postgres‑mcp‑server allows an unauthenticated attacker to run arbitrary operating‑system commands on the host. The flaw is triggered by a specially crafted COPY … TO PROGRAM statement that is processed in read‑only mode. Updating to version 1.1.7 or later removes the weakness.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Amazon awslabs postgres‑mcp‑server, versions prior to 1.1.7, used by administrators running self‑managed PostgreSQL servers.
Real-world impact
An attacker could execute any command on the server, potentially taking full control, exfiltrating data, or installing malware.
Why this severity
The CVSS score of 9 reflects the combination of network reachability, low attack complexity, no authentication, and the ability to compromise confidentiality, integrity, and availability of the host system.
What to do about it
- 01Upgrade Amazon awslabs postgres‑mcp‑server to version 1.1.7 or later.
NVD-referenced vendor advisory
Timeline
- Sep 9, 2026 · 4d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 4d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.