pgEdge Postgres MCP Server: Login rate limiting bypass (CVE-2026-125321)

pgEdge Postgres MCP Server versions prior to 1.1.0 contain a vulnerability (CVE-2026-125321) in the login rate limiting mechanism. The implementation relies on the leftmost value of the caller-supplied 'X-Forwarded-For' header to identify the client IP address. An attacker can manipulate this header to rotate perceived IP addresses, thereby evading rate limiting or exhausting the rate limit bucket of other users. This issue is reachable when the HTTP transport is enabled, especially if the deployment configuration appends rather than replaces the 'X-Forwarded-For' header.

Impact

Successful exploitation allows unauthenticated attackers to bypass login rate limits, facilitating brute-force or credential stuffing attacks against the Postgres MCP server.

Recommendation

• Upgrade pgEdge Postgres MCP Server to version 1.1.0 or later immediately.
• Review ingress and proxy configurations to ensure that 'X-Forwarded-For' headers are sanitized and correctly replaced by trusted upstream proxies before reaching the application.
• Audit logs for repeated login failures originating from diverse or suspicious 'X-Forwarded-For' header values.