{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apgedgepostgres_mcp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pgedge:postgres_mcp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.5,"id":"CVE-2026-125321"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Postgres MCP Server (\u003c 1.1.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["pgEdge"],"content_html":"\u003cp\u003epgEdge Postgres MCP Server versions prior to 1.1.0 contain a vulnerability (CVE-2026-125321) in the login rate limiting mechanism. The implementation relies on the leftmost value of the caller-supplied 'X-Forwarded-For' header to identify the client IP address. An attacker can manipulate this header to rotate perceived IP addresses, thereby evading rate limiting or exhausting the rate limit bucket of other users. This issue is reachable when the HTTP transport is enabled, especially if the deployment configuration appends rather than replaces the 'X-Forwarded-For' header.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to bypass login rate limits, facilitating brute-force or credential stuffing attacks against the Postgres MCP server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade pgEdge Postgres MCP Server to version 1.1.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview ingress and proxy configurations to ensure that 'X-Forwarded-For' headers are sanitized and correctly replaced by trusted upstream proxies before reaching the application.\u003c/li\u003e\n\u003cli\u003eAudit logs for repeated login failures originating from diverse or suspicious 'X-Forwarded-For' header values.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T18:59:43Z","date_published":"2026-11-10T18:59:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pgedge-mcp-rate-limit-evasion/","summary":"pgEdge Postgres MCP Server versions prior to 1.1.0 contain a vulnerability where an attacker can bypass login rate limiting by manipulating the X-Forwarded-For HTTP header.","title":"pgEdge Postgres MCP Server: Login rate limiting bypass (CVE-2026-125321)","url":"https://feed.craftedsignal.io/briefs/2026-11-pgedge-mcp-rate-limit-evasion/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:pgedge:postgres_mcp:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}