SQL Injection Vulnerability in pgEdge Postgres MCP Server

CVE-2026-125321

What is CVE-2026-125321?

The pgEdge Postgres MCP Server prior to version 1.1.0 is susceptible to an authentication bypass due to improper handling of the X-Forwarded-For header. This flaw allows malicious users to exploit the server's login rate limiting by rotating IP addresses, thereby evading throttling mechanisms designed to restrict failed login attempts. The issue arises as the server's configuration appends rather than replaces the received X-Forwarded-For values, which can mislead the server into misidentifying the original client address. Additionally, default settings for account lockout do not segregate limits based on client addressing, exacerbating the risk of unauthorized access. The vulnerability has been addressed in version 1.1.0.

References