CVE-2026-85787

MediumCVSS 6.5/10Last modified Sep 8, 2026

Description

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server.

To remediate this issue, users should upgrade to version 1.1.7 or above.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-184

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 4, 2026
Last modified
Sep 8, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-857885.5Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent CVE-2026-85793.1Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised thCVE-2026-857905.9Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.CVE-2026-857917.0Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.CVE-2026-857929.8Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machineCVE-2026-857935.5Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclCVE-2026-857945.5Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information locally.CVE-2026-857957.8Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.CVE-2026-857967.8Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-857977.5Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.CVE-2026-857987.2Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.CVE-2026-857998.1Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
CVE-2026-85787: Medium severity, CVSS 6.5 | Vulnix