CVE-2026-87911: AWS postgres-mcp-server hits CVSS 9.6 because read-only mode never blocked COPY ... TO PROGRAM
NVD·high signal
The SQL validation component in awslabs postgres-mcp-server before 1.1.7 fails to catch `COPY ... TO PROGRAM` in its default read-only mode, letting an unauthenticated actor plant the statement in content the agent later processes and get OS command execution on a self-managed PostgreSQL host. NVD published it 2026-09-09 at CVSS 9.6 critical, with an AWS security bulletin (2026-104) and GHSA-fph8-pg5w-78fv confirming. Upgrade to 1.1.7; this is the second Postgres MCP read-only bypass in two weeks, so treat 'read-only' MCP grants as an unenforced label rather than a boundary.