io.github.pgEdge/postgres-mcp
Enterprise PostgreSQL MCP server with NL queries, hybrid search (pgvector+BM25), and web UI
1.0.0version the registry lists (1 published)
3reported issues
Nolisted version affected
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name io.github.pgEdge/postgres-mcp
· Source code
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| CVE-2026-125320pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker… | medium | Not checked | Nov 10, 2026 |
| CVE-2026-125321pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-su… | medium | Not checked | Nov 10, 2026 |
| CVE-2026-125322pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named i… | medium | Not checked | Nov 10, 2026 |
Versions in the registry
1.0.0 (listed)