What happened
CVE-2026-87911 (CVSS 9.6, critical) is an OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7. The validation layer failed to block a crafted PostgreSQL COPY ... TO PROGRAM statement, which PostgreSQL executes as an OS-level command, allowing an unauthenticated actor to execute arbitrary operating system commands on the host of a self-managed PostgreSQL server despite the MCP server being configured in read-only mode.
Why it matters
MCP servers are the standard tool-calling bridge between LLM agents and backend systems; a database MCP server that is supposed to enforce read-only access but instead permits OS command execution completely defeats the security boundary that agent operators rely on to safely expose a database to an LLM agent. Any agent architecture that grants an LLM 'read-only' database access via this MCP server was actually exposed to full host compromise on the PostgreSQL server.
Attack vector
An actor (potentially an LLM agent coerced via prompt injection, or any user of the MCP tool interface) submits a crafted SQL statement using PostgreSQL's COPY ... TO PROGRAM syntax; the read-only SQL validator fails to recognize this as a mutating/OS-executing operation, allowing arbitrary command execution on the PostgreSQL host.
Affected systems
Amazon awslabs postgres-mcp-server before 1.1.7
Mitigation
Upgrade to postgres-mcp-server 1.1.7 or later. AWS recommends additionally running the MCP server under a dedicated, minimal-privilege PostgreSQL role as defense in depth.