pgEdge Postgres MCP Server: DNS rebinding via Origin header validation flaw (CVE-2026-125320)

The pgEdge Postgres MCP Server (prior to version 1.1.0) contains a vulnerability in its HTTP transport mechanism where the Origin header is not validated. An attacker can leverage this via DNS rebinding when a user visits a malicious website while the pgEdge service is running locally on the same machine. This enables the attacker to interact with the server and read database schemas or query results from connected PostgreSQL databases. The default stdio transport method is not affected.

Impact

Successful exploitation allows unauthorized access to sensitive database schemas and query results. The impact is limited to the data accessible to the pgEdge Postgres MCP Server instance.

Recommendation

• Upgrade the pgEdge Postgres MCP Server to version 1.1.0 or later immediately to apply the Origin header validation fix.
• Audit environments for workstations running the pgEdge Postgres MCP Server with HTTP transport enabled.
• If immediate patching is not possible, disable the HTTP transport and utilize the stdio transport exclusively.