What happened
Before 1.1.0, the query_database tool on a read_only connection could pass unrecognized statements through pgx Exec without bind parameters, which selects the simple query protocol (multiple statements) and bypasses the read-only enforcement that prevents data modification.
Why it matters
In an AI/RAG deployment the MCP server is the write path into the database for agent workflows. This bypass lets an agent (or an indirect prompt injection steering it) perform writes despite a read-only DB role being deliberately configured.
Attack vector
query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query protocol and bypassing the read-only enforcement.
Affected systems
pgedge-postgres-mcp < 1.1.0
Mitigation
Upgrade to pgedge-postgres-mcp 1.1.0. Use least-privilege DB roles; monitor for unexpected writes from the MCP connection.