{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apgedgepostgres_mcp_server/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pgedge:postgres_mcp_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2026-125320"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pgEdge Postgres MCP Server (\u003c 1.1.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["pgEdge"],"content_html":"\u003cp\u003eThe pgEdge Postgres MCP Server (prior to version 1.1.0) contains a vulnerability in its HTTP transport mechanism where the Origin header is not validated. An attacker can leverage this via DNS rebinding when a user visits a malicious website while the pgEdge service is running locally on the same machine. This enables the attacker to interact with the server and read database schemas or query results from connected PostgreSQL databases. The default stdio transport method is not affected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized access to sensitive database schemas and query results. The impact is limited to the data accessible to the pgEdge Postgres MCP Server instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the pgEdge Postgres MCP Server to version 1.1.0 or later immediately to apply the Origin header validation fix.\u003c/li\u003e\n\u003cli\u003eAudit environments for workstations running the pgEdge Postgres MCP Server with HTTP transport enabled.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, disable the HTTP transport and utilize the stdio transport exclusively.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T18:59:54Z","date_published":"2026-11-10T18:59:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pgedge-mcp-dns-rebinding/","summary":"The pgEdge Postgres MCP Server prior to version 1.1.0 fails to validate the Origin header, enabling DNS rebinding attacks that allow an attacker-controlled web page to exfiltrate database schemas and query results.","title":"pgEdge Postgres MCP Server: DNS rebinding via Origin header validation flaw (CVE-2026-125320)","url":"https://feed.craftedsignal.io/briefs/2026-11-pgedge-mcp-dns-rebinding/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:pgedge:postgres_mcp_server:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}