awslabs.postgres-mcp-server command injection vulnerability
Start here
AWS advisory discloses an OS command injection vulnerability in awslabs.postgres-mcp-server before version 1.1.7, with risk involving self-managed PostgreSQL deployments using high-privilege database roles under specific connection methods; users with least-privilege roles are not within the scope of impact described in the advisory. The issue is fixed in 1.1.7, and the advisory recommends upgrading and maintaining least privilege at the database layer.
Generated by AI from reports · Updated 4 days ago
Progress timeline
- Date not givenGitHub 安全公告SelectedAWS fixes OS command injection vulnerability in read-only mode of awslabs.postgres-mcp-server
AWS advisory discloses a command injection vulnerability in awslabs.postgres-mcp-server before version 1.1.7. The risk involves self-managed PostgreSQL deployments using high-privilege database roles under specific connection methods; users with least-privilege roles are not within the scope of impact described in the advisory. The issue is fixed in 1.1.7, and the advisory recommends upgrading and maintaining least privilege at the database layer.
Related discussion
Attention trend
New sources per day
- Oct 7: 1 new sources (1 outlets, 0 accounts)
- Oct 8: 0 new sources (0 outlets, 0 accounts)
- Oct 9: 0 new sources (0 outlets, 0 accounts)
- Oct 10: 0 new sources (0 outlets, 0 accounts)
- Oct 11: 0 new sources (0 outlets, 0 accounts)
- Oct 12: 0 new sources (0 outlets, 0 accounts)
- Oct 13: 0 new sources (0 outlets, 0 accounts)
- Oct 14: 0 new sources (0 outlets, 0 accounts)