pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content.
The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909c…
security-advisories@github.com
https://github.com/pgEdge/pgedge-postgres-mcp/pull/198
security-advisories@github.com
https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0
security-advisories@github.com
https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg…
security-advisories@github.com