CVE-2026-125320

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0.

• CWE-346

• https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e
• https://github.com/pgEdge/pgedge-postgres-mcp/issues/231
• https://github.com/pgEdge/pgedge-postgres-mcp/pull/232
• https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0
• https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125270FFmpeg through 9.0.2 contains a heap out-of-bounds read vuln…5.3
• CVE-2026-125271Incorrect normalization of operation names in the custom sec…7.8
• CVE-2026-12528A flaw was found in 389 Directory Server in the __aclp__norm…5.4
• CVE-2026-12529A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-1253The Group Chat & Video Chat by AtomChat plugin for WordPress…4.3
• CVE-2026-12530Improper neutralization of argument delimiters in the instal…7.3
• CVE-2026-125321pgEdge Postgres MCP Server enables SQL queries against Postg…6.5
• CVE-2026-125322pgEdge Postgres MCP Server enables SQL queries against Postg…6.5
• CVE-2026-125323pgEdge Control Plane is a distributed application for managi…7.8
• CVE-2026-125325pgEdge RAG Server is an API server for retrieval-augmented g…5.9
• CVE-2026-125326pgEdge RAG Server is an API server for retrieval-augmented g…5.8
• CVE-2026-125342Uninitialized resource in GPU in Google Chrome prior to 157.…