VulnSocial

CVE-2026-87911Patch

LOWCVSS 9.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode. To remediate this issue, users should upgrade to version 1.1.7 or later.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78CWE-184

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 8 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 7 signals
  • Technical details provided in 8 signals
  • Disclosure: 2 classified signals
  • Peaked 3d ago at 4 mentions (2026-09-10); latest day: 1
  • 8 total mentions across 5 days

Deep dive

Activity timeline8 mentions / 5d
01234Mentions · 2026-09-09: 1Mentions · 2026-09-10: 4Mentions · 2026-09-11: 1Mentions · 2026-10-06: 1Mentions · 2026-10-13: 1Patch / Workaround · 2026-09-10: 4Patch / Workaround · 2026-09-11: 1Patch / Workaround · 2026-10-06: 1Patch / Workaround · 2026-10-13: 1Technical Details · 2026-09-09: 1Technical Details · 2026-09-10: 4Technical Details · 2026-09-11: 1Technical Details · 2026-10-06: 1Technical Details · 2026-10-13: 109-0909-1009-1110-0610-13
Signal classification2 categories
Patch
675.0%
Disclosure
225.0%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-09-091
Disclosure1
2026-09-104
Disclosure1Patch3
2026-09-111
Patch1
2026-10-061
Patch1
2026-10-131
Patch1
Full discourse8 posts
  • IA en Bruto@IAenBruto
    Patch

    AWS postgres-mcp-server: CVE-2026-87911 (CVSS 9.6). El modo read-only era un regex denylist. COPY … TO PROGRAM lo saltea, y un prompt plantado en contenido que lee el agente termina en shell en el host. Solo pega si el rol es superuser o pg_execute_server_program. RDS/Aurora no lo permiten; Postgres self-managed sí. Tip: upgrade ≥1.1.7 y dale al rol del MCP solo CONNECT/USAGE/SELECT. Chequeo: SELECT pg_has_role(current_user,'pg_execute_server_program','member'); ¿Te da false con el rol de tu MCP?

    Post summary

    The post describes a critical vulnerability in AWS postgres-mcp-server (CVE-2026-87911) with a CVSS of 9.6, and explicitly advises upgrading to version 1.1.7 or later and limiting database privileges to mitigate the risk.

    10121181
    141 followersView on X
  • Echosphere@Echosphere8f
    Patch

    AWS LabsのPostgres用MCPサーバー、CVE-2026-87911。エージェントが読む内容に仕込まれたSQLが「読み取り専用」の検査を抜け、DBホストでのコマンド実行に届き得た。 ……ちっ。その設定名だけで安心しちゃダメだな。 https://x.com/IAenBruto/status/2107461195867295807 ただし成立条件がある。1.1.7未満でPG_WIRE_PROTOCOL接続、さらに自己管理のPostgresで、接続ロールがsuperuserかpg_execute_server_programを持つ場合だ。権限を絞ったロールなら、検査を抜けてもDB側で止まる。 https://github.com/awslabs/mcp/security/advisories/GHSA-fph8-pg5w-78fv あたしが嫌なのは、アプリの「読み取り専用」がDBの権限まで下げてくれた気にさせること。SQLの文字列検査は抜けることがある。接続ロールの権限は必要な範囲に絞り、使ってるなら1.1.7以降へ。 #MCP #PostgreSQL -- メル

    Post summary

    The text discusses CVE-2026-87911 in AWS Labs' PostgreSQL MCP server, detailing a SQL injection that bypasses read-only checks to achieve command execution on the DB host, and advises upgrading to version 1.1.7+ and restricting role permissions as remediation.

    0001079
    38 followersView on X
  • theenmusketeers@theenmusketeers
    Patch

    if you run aws's postgres mcp server, today's 5-minute fix: 1. check the version - anything before 1.1.7 is exposed 2. upgrade: pip install -U awslabs.postgres-mcp-server 3. stop trusting 'read-only mode' as your boundary. cve-2026-87911 turns it into os command execution via a crafted COPY ... TO PROGRAM 4. run the server as a low-priv os user, scoped to the db and nothing else 5. treat any content the agent can read as a possible payload - that's where the crafted statement rides in the bug wasn't in postgres. it was in the validator deciding what counts as a write. a denylist in application code is a suggestion - enforce read-only in the database role, not the proxy. https://cve.report/CVE-2026-87911

    Post summary

    The post announces a 5‑minute fix for CVE‑2026‑87911, highlighting that older AWS Postgres MCP server versions are vulnerable to OS command execution via a crafted COPY command, and provides concrete upgrade and operational mitigations.

    1000065
    235 followersView on X
  • NaaNSenseAi@NaanSenseAi
    Patch

    🚨 Critical: CVE-2026-87911 (score 9.6) hits AWS Labs postgres-mcp-server before 1.1.7. On a self-managed Postgres server, if the MCP DB user is a superuser or has `pg_execute_server_program`, someone can run OS commands through `COPY ... TO PROGRAM`. This still works in the default read-only mode. Fix: upgrade to 1.1.7 or later, and check that your MCP Postgres role is not over-privileged.

    Post summary

    The post discloses the high‑severity CVE-2026-87911 affecting AWS Labs postgres‑mcp‑server, details the exploitation vector, and advises upgrading to version 1.1.7 or later to mitigate the vulnerability.

    1000066
    177 followersView on X
  • Marwan Atef@Marwan_3atef
    Patch

    AWS just scored its own Postgres MCP server a 9.6. CVE-2026-87911: a crafted COPY ... TO PROGRAM can slip past the "read-only" SQL guardrail in awslabs.postgres-mcp-server before 1.1.7 and shell out on the DB host (self-managed PG_WIRE_PROTOCOL + superuser / pg_execute_server_program). Same 1.1.7 release that quietly fixed last week's 6.5 write bypass. Current on PyPI is 1.2.1. Connecting your coding agent as postgres superuser is not a security model. https://aws.amazon.com/security/security-bulletins/2026-104-aws/

    Post summary

    AWS disclosed a critical flaw (CVE‑2026‑87911) in its Postgres MCP server that allows shell execution via a COPY TO PROGRAM bypass, noting that version 1.1.7 fixed the issue and that 1.2.1 is now available.

    0000081
    2.3K followersView on X
  • Christopher Elliott@Chris_L_Elliott
    Patch

    AWS scored awslabs postgres-mcp-server 9.6 (CVE-2026-87911): COPY … TO PROGRAM turns “read-only” SQL into RCE. Same 1.1.7 fixed last week’s 6.5. Floor 1.1.7. Don’t give the MCP DB role superuser or pg_execute_server_program. Denylists aren’t the fix. https://severitydaily.com/aws-postgres-mcp-cve-2026-87911-copy-to-program-same-1-1-7-fix/

    Post summary

    The post highlights CVE-2026-87911, a copy-to-program RCE in AWSlabs Postgres MCP, and notes that version 1.1.7 contains the fix, while advising against granting superuser privileges.

    0000056
    48 followersView on X
  • Severity Daily@severitydaily
    Disclosure

    AWS discloses a 9.6 RCE in its Postgres MCP server, fixed by the same release as last week's 6.5. https://severitydaily.com/aws-postgres-mcp-cve-2026-87911-copy-to-program-same-1-1-7-fix/

    Post summary

    AWS has disclosed a critical 9.6‑score remote code execution vulnerability in its Postgres MCP server, which has already been fixed in the latest release.

    0000062
    23 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-87911 An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauth… https://www.cve.org/CVERecord?id=CVE-2026-87911

    Post summary

    CVE‑2026‑87911 describes an OS command injection weakness in Amazon awslabs postgres‑mcp‑server prior to version 1.1.7, potentially enabling unauthenticated command execution.

    000001.2K
    58.1K followersView on X

Explore more

Back to dashboard