Description

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode. To remediate this issue, users should upgrade to version 1.1.7 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-09T20:21:02.017Z",
  "pubdate": "2026-09-09T20:21:02.017Z",
  "executiveSummary": "The vulnerability is an OS command injection flaw located within the read-only enforcement mechanism of the postgres-mcp-server SQL validation component.\nThis security defect permits an unauthenticated actor to execute arbitrary operating system commands on the underlying host of a self-managed PostgreSQL server.\nThe issue stems from insufficient input validation when processing SQL queries, specifically involving the COPY ... TO PROGRAM statement, which is erroneously permitted even when the server is configured in its default read-only mode.\nSuccessful exploitation allows an attacker to achieve Remote Code Execution (RCE) on the server host, potentially leading to full system compromise, data exfiltration, or lateral movement within the infrastructure.\nThe risk is critical, as it bypasses intended read-only restrictions. While the interaction occurs when an authenticated user utilizes the MCP server, the underlying vulnerability remains a significant threat to the host environment's integrity.\nUsers are strongly advised to upgrade to version 1.1.7 or later to address the root cause of this improper input sanitization.",
  "technicalDetails": "The vulnerability exists within the SQL validation logic of the postgres-mcp-server, which fails to adequately restrict hazardous SQL commands when operating in a restricted read-only context.\nThe root cause is a failure in the input validation component to filter or neutralize the 'COPY ... TO PROGRAM' SQL command, which is a PostgreSQL feature that interfaces with the underlying host OS to execute shell commands.\nUnder normal conditions, a read-only enforcement component should restrict queries to data retrieval operations (e.g., SELECT) and block any Data Definition Language (DDL) or Data Control Language (DCL) operations that interact with the host system.\nIn this specific implementation, the validation logic incorrectly permits the 'COPY' statement to pass through, assuming it adheres to read-only constraints, thereby ignoring the dangerous side-effects associated with the 'TO PROGRAM' clause.\nThe exploitation flow begins when an attacker crafts a malicious payload containing a 'COPY (SELECT ...) TO PROGRAM 'command string''. When this content is processed by the postgres-mcp-server, the system interprets the input as a valid SQL statement.\nBecause the validation engine does not block the 'TO PROGRAM' directive, the PostgreSQL engine executes the specified command string with the privileges of the database service process running on the host.\nThis allows for arbitrary code execution on the host machine, independent of the intended read-only database session constraints.\nThe impact includes complete compromise of the PostgreSQL host, potentially granting the attacker access to configuration files, system credentials, and the ability to interact with other network services accessible from the compromised host.\nThis vulnerability affects versions of postgres-mcp-server prior to 1.1.7. It is particularly dangerous because it bypasses architectural security controls intended to limit the scope of the MCP server's interactions with the database.\nThe attack is facilitated through the manipulation of input that is subsequently processed by an authenticated session, meaning the system-level compromise originates from the application layer's failure to enforce strict query sanitization policies against host-interaction primitives."
}