CVE-2026-125320

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-125320
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125320.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-125320
Aliases
  • GHSA-6hg5-9f3w-c886
Published
2026-11-10T17:23:43Z
Modified
2026-11-11T02:49:08Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding
Details

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-346"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125320.json"
}
References

Affected packages

Git / github.com/pgedge/pgedge-postgres-mcp

Affected ranges

Type
GIT
Repo
https://github.com/pgedge/pgedge-postgres-mcp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
25c2aaed03398584ceea0dd71f7f67631c3dff4e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.1.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        }
    ]
}

Affected versions

Other
kb-2026-04-22
kb-2026-04-27
v1.*
v1.0.0
v1.0.0-alpha1
v1.0.0-alpha2
v1.0.0-alpha3
v1.0.0-alpha4
v1.0.0-alpha5
v1.0.0-alpha6
v1.0.0-beta1
v1.0.0-beta3
v1.0.0-beta3a
v1.1.0-beta1
v1.1.0-beta2
v1.1.0-beta3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125320.json"