What happened
Three closely related MCP-server defects fixed in 1.1.0: missing Origin validation (CVE-2026-125320), trusting the leftmost X-Forwarded-For as the client address (CVE-2026-125321), and allowing the count_rows 'where' parameter to reference tables outside the named table (CVE-2026-125322). CVSS 5.3/6.5/6.5.
Why it matters
These are classic web-request-hygiene gaps that, on an MCP SQL server, let a prompt-injected or network attacker reach cross-table query results or abuse rate-limiting/auth decisions.
Attack vector
The HTTP transport didn't validate the Origin header, so a user visiting an attacker-controlled page can be targeted through DNS rebinding to reach the MCP endpoint; separately, the leftmost caller-supplied X-Forwarded-For was used as the client address for rate-limit/auth decisions, and the count_rows 'where' parameter accepted subqueries against tables other than the named one.
Affected systems
pgEdge Postgres MCP Server < 1.1.0
Mitigation
Upgrade pgEdge Postgres MCP Server to 1.1.0.