CVE-2026-125322

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-125322
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125322.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-125322
Aliases
  • GHSA-fhv3-x3jh-grj7
Published
2026-11-10T17:39:00Z
Modified
2026-11-11T02:49:08Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
pgEdge Postgres MCP Server SQL injection in the count_rows where parameter
Details

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-209",
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125322.json"
}
References

Affected packages

Git / github.com/pgedge/pgedge-postgres-mcp

Affected ranges

Type
GIT
Repo
https://github.com/pgedge/pgedge-postgres-mcp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
25c2aaed03398584ceea0dd71f7f67631c3dff4e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.1.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        }
    ]
}

Affected versions

Other
kb-2026-04-22
kb-2026-04-27
v1.*
v1.0.0
v1.0.0-alpha1
v1.0.0-alpha2
v1.0.0-alpha3
v1.0.0-alpha4
v1.0.0-alpha5
v1.0.0-alpha6
v1.0.0-beta1
v1.0.0-beta3
v1.0.0-beta3a
v1.1.0-beta1
v1.1.0-beta2
v1.1.0-beta3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125322.json"