{"id":8865,"date":"2026-11-13T11:21:35","date_gmt":"2026-11-13T11:21:35","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass"},"modified":"2026-11-13T11:21:35","modified_gmt":"2026-11-13T11:21:35","slug":"cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass","title":{"rendered":"CVE-2026-126196: pgEdge Postgres MCP Server read-only bypass via SQL statement smuggling"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> CVE-2026-126196 allowed SQL statement smuggling to bypass read-only mode in pgEdge Postgres MCP Server, enabling unauthorized database writes.<\/li><li><strong>Who is affected:<\/strong> Any deployment of pgEdge Postgres MCP Server version 1.0.0 or earlier that relies on read_only mode as a safety boundary and connects with a role holding write privileges.<\/li><li><strong>Fixed version:<\/strong> 1.1.0<\/li><li><strong>What to do:<\/strong> Upgrade to version 1.1.0 or later and review database audit logs for unexpected DDL or DML issued through the MCP connection.<\/li><li><strong>Severity:<\/strong> High (CVSS 8.1)<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A security flaw in pgEdge Postgres MCP Server let someone send multiple SQL commands in a single request to a database connection that was supposed to be read-only. By adding extra commands after a semicolon, an attacker could change the connection to read-write mode and then create, modify, or delete database tables. The problem is fixed in version 1.1.0, which now only allows one SQL statement per request on read-only connections. If you use this tool to connect to PostgreSQL databases through AI agents or Model Context Protocol clients, you should upgrade immediately and check your database logs to see if anyone exploited this flaw. If you don&#8217;t use pgEdge Postgres MCP Server, you can ignore this.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to version 1.1.0, the <code>query_database<\/code> tool on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL&#8217;s simple query protocol and allowing multiple semicolon-separated statements in one request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A caller could combine transaction or session state changes with database writes. For example, they could append <code>SET TRANSACTION READ WRITE<\/code> or <code>COMMIT; BEGIN READ WRITE<\/code> to a request, then write to the database. The flaw was demonstrated by pgEdge engineering against a throwaway PostgreSQL 17.10 instance, creating, altering and dropping real tables.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability had several contributing causes:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>The textual guard matched only the literal strings <code>transaction_read_only<\/code> and <code>default_transaction_read_only<\/code>, and never checked <code>READ WRITE<\/code> or <code>SESSION CHARACTERISTICS<\/code>.<\/li><li>Read detection used <code>strings.HasPrefix<\/code> against <code>SELECT<\/code>, <code>WITH<\/code>, <code>TABLE<\/code> and <code>VALUES<\/code>, so anything not recognized as a read (including a read behind a leading comment) was sent down the Exec path.<\/li><li>That path called <code>tx.Exec(ctx, sqlQuery)<\/code> with no bind parameters, so pgx used the PostgreSQL simple query protocol, which accepts several semicolon-separated statements in one message.<\/li><li>Session state persisted on pooled connections, so a <code>RESET ALL<\/code> or <code>DISCARD ALL<\/code> that cleared <code>default_transaction_read_only<\/code> on one call left the connection writable by default for later calls.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The flaw affected deployments relying on read_only as a safety boundary and could compromise integrity and availability. Confidentiality was unaffected, since a read-only connection already permits reads.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade to version 1.1.0 or later immediately. After upgrading, review your database audit logs for unexpected DDL or DML issued through the MCP connection. Upgrading prevents further writes but does not tell you whether any occurred.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As a workaround, you can grant the connecting role no write privileges. This is effective, since every route to a write goes through the database&#8217;s own permission check, but it removes any legitimate write capability along with the bypass.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In version 1.1.0, on a read-only connection every <code>query_database<\/code> statement now uses the extended query protocol, which carries one statement per message, so a multi-statement request is rejected before execution. The guard now inspects the statement with comments removed and literals blanked, and rejects read-write transaction modes, session characteristics, <code>RESET ALL<\/code>, <code>DISCARD<\/code>, transaction control and role changes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Every tool sets the read-only access mode on <code>BEGIN<\/code>, and the session default is re-applied whenever a connection is returned to the pool, with the connection discarded if that fails.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The advisory notes that connections configured with <code>allow_writes: true<\/code> keep the previous behaviour, including support for multi-statement scripts, since there is no boundary left to protect in that configuration.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/github.com\/pgEdge\/pgedge-postgres-mcp\/security\/advisories\/GHSA-j7mp-839j-jrm7\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Security Advisory GHSA-j7mp-839j-jrm7<\/a><\/li><li><a href=\"https:\/\/github.com\/pgEdge\/pgedge-postgres-mcp\/pull\/196\" target=\"_blank\" rel=\"noreferrer noopener\">Pull Request #196: Harden the read-only guardrails<\/a><\/li><li><a href=\"https:\/\/github.com\/pgEdge\/pgedge-postgres-mcp\/commit\/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868\" target=\"_blank\" rel=\"noreferrer noopener\">Commit b5b9293<\/a><\/li><li><a href=\"https:\/\/github.com\/pgEdge\/pgedge-postgres-mcp\/releases\/tag\/v1.1.0\" target=\"_blank\" rel=\"noreferrer noopener\">Release v1.1.0<\/a><\/li><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-126196\" target=\"_blank\" rel=\"noreferrer noopener\">NVD CVE-2026-126196<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A high-severity flaw in pgEdge Postgres MCP Server allowed callers to bypass read-only mode and write to databases by smuggling SQL statements through the query_database tool. Fixed in version 1.1.0.<\/p>\n","protected":false},"author":2,"featured_media":8864,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"high","_nx_sec_affected":"pgEdge Postgres MCP Server versions 1.0.0 and earlier","_nx_sec_status":"patch-available","_nx_sec_kicker":"URGENT: SQL smuggling bypasses read-only mode in pgEdge MCP Server","_nx_sec_type":"mcp","_nx_sec_vendor":"pgEdge","_nx_sec_fixed":"1.1.0","_nx_sec_action":""},"categories":[14,65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8865","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-126196: pgEdge MCP Server read-only bypass fixed<\/title>\n<meta name=\"description\" content=\"CVE-2026-126196 let attackers bypass read-only mode in pgEdge Postgres MCP Server via SQL smuggling. Fixed in 1.1.0. Upgrade now.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-126196: pgEdge MCP Server read-only bypass fixed\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-126196 let attackers bypass read-only mode in pgEdge Postgres MCP Server via SQL smuggling. Fixed in 1.1.0. Upgrade now.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T11:21:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-126196: pgEdge Postgres MCP Server read-only bypass via SQL statement smuggling\",\"datePublished\":\"2026-11-13T11:21:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass\"},\"wordCount\":638,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass-title.webp\",\"articleSection\":[\"Agents\",\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-13T11:21:35+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass\",\"name\":\"CVE-2026-126196: pgEdge MCP Server read-only bypass fixed\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass-title.webp\",\"datePublished\":\"2026-11-13T11:21:35+00:00\",\"description\":\"CVE-2026-126196 let attackers bypass read-only mode in pgEdge Postgres MCP Server via SQL smuggling. Fixed in 1.1.0. Upgrade now.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-126196: pgEdge Postgres MCP Server read-only bypass via SQL statement smuggling\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-126196: pgEdge MCP Server read-only bypass fixed","description":"CVE-2026-126196 let attackers bypass read-only mode in pgEdge Postgres MCP Server via SQL smuggling. Fixed in 1.1.0. Upgrade now.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-126196: pgEdge MCP Server read-only bypass fixed","og_description":"CVE-2026-126196 let attackers bypass read-only mode in pgEdge Postgres MCP Server via SQL smuggling. Fixed in 1.1.0. Upgrade now.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass","og_site_name":"i10X News","article_published_time":"2026-11-13T11:21:35+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-126196: pgEdge Postgres MCP Server read-only bypass via SQL statement smuggling","datePublished":"2026-11-13T11:21:35+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass"},"wordCount":638,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass-title.webp","articleSection":["Agents","AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-13T11:21:35+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass","name":"CVE-2026-126196: pgEdge MCP Server read-only bypass fixed","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass-title.webp","datePublished":"2026-11-13T11:21:35+00:00","description":"CVE-2026-126196 let attackers bypass read-only mode in pgEdge Postgres MCP Server via SQL smuggling. Fixed in 1.1.0. Upgrade now.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126196-pgedge-postgres-mcp-server-read-only-bypass#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-126196: pgEdge Postgres MCP Server read-only bypass via SQL statement smuggling"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8865"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8865\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8864"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8865"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8865"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}