External risk intelligence

Amazon awslabs postgres-mcp-server OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-87911

The vulnerability exists in a server-side component for Model Context Protocol (MCP) used with PostgreSQL. While such servers may be exposed to facilitate LLM integration, they are typically deployed as internal services or development tools rather than public-facing edge gateways or standard web applications, making internet reachability possible but not the default common deployment pattern.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in a component related to PostgreSQL database management, specifically within the `postgres-mcp-server` software. This issue could allow an attacker to execute commands on the server hosting the database if certain conditions are met. The primary concern is to confirm if this specific technology is in use and if it is exposed in a way that could be targeted.

Unauthenticated command execution risk in PostgreSQL component.
Leadership should remember this due to potential server compromise.
Confirm relevance and exposure of this specific technology.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to a PostgreSQL server. This data, when processed by the SQL validation component, could trick the server into executing arbitrary operating system commands. This is possible even if the attacker is unauthenticated and the server is in its default read-only configuration, potentially leading to significant compromise of the host system.

No authentication or prior access needed.
Crafted data triggers OS command execution.
Risk of full host system compromise.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated actor could execute operating system commands on a self-managed PostgreSQL server when an authenticated user interacts with the MCP server, by placing a crafted SQL statement into content processed by the server. This could allow for unauthorized actions on the server's operating system.

Host OS commands.
Crafted SQL statement injection.
Compromise of server operating system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the SQL validation component of the `awslabs postgres-mcp-server` affects self-managed PostgreSQL servers. Teams responsible for PostgreSQL infrastructure and any teams utilizing the `postgres-mcp-server` for application integration should take immediate action. The first practical step is to identify all instances of the affected `postgres-mcp-server`, determine their exposure and criticality, and then coordinate remediation with the relevant application or infrastructure owners.

Infrastructure and application owners should manage remediation.
Verify `postgres-mcp-server` instances and their reachability.
Plan upgrades or vendor coordination for affected systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the awslabs postgres-mcp-server?

The postgres-mcp-server is a component designed to bridge PostgreSQL databases with the Model Context Protocol (MCP). It allows developers to integrate database data into AI models, enabling these models to interact with database structures. It is often used in self-managed environments to provide LLMs with structured access to internal data, effectively acting as an intermediary for database-driven AI workflows.

What does OS command injection mean for CVE-2026-87911?

This vulnerability, classified as CWE-78 (OS Command Injection), occurs when an application improperly filters input before passing it to a system command. In this case, the SQL validation component fails to stop malicious commands embedded in specific SQL statements. Because the server treats these inputs as trusted instructions, an attacker can trick the underlying host into running unauthorized commands, gaining control over the server's operating system.

How is this vulnerability triggered?

An attacker triggers the flaw by submitting a crafted COPY TO PROGRAM statement into content processed by the server. This vulnerability does not require authentication; however, the attack relies on the server processing this malicious input during an interaction with the MCP server. Simply having the server installed is not enough; the SQL validation component must encounter and process the specific malformed SQL data to initiate the command injection.

Is my system at risk if it is not internet-facing?

According to Halo Surface Signal, while internet reachability is possible, these servers are typically deployed as internal services or development tools. An internal-only configuration reduces the risk from broad internet scans, but the vulnerability remains a concern if an attacker gains access to your internal network or influences the data processed by the MCP server, regardless of the server's specific network perimeter placement.

What are the first steps to address this issue?

The immediate priority is to locate all instances of the awslabs postgres-mcp-server within your environment. Once identified, evaluate which servers are active and who owns them. The definitive remedy is to upgrade the software to version 1.1.7 or later, which contains the fix for the SQL validation flaw. Coordinate with your infrastructure and application teams to apply this update and verify the deployment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.