PgEdge Postgres MCP Server (< 1.1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pgedge-postgres-mcp-server--1.1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 18:59:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgpgEdge Postgres MCP Server: DNS rebinding via Origin header validation flaw (CVE-2026-125320)https://feed.craftedsignal.io/briefs/2026-11-pgedge-mcp-dns-rebinding/Tue, 10 Nov 2026 18:59:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pgedge-mcp-dns-rebinding/The pgEdge Postgres MCP Server prior to version 1.1.0 fails to validate the Origin header, enabling DNS rebinding attacks that allow an attacker-controlled web page to exfiltrate database schemas and query results.The pgEdge Postgres MCP Server (prior to version 1.1.0) contains a vulnerability in its HTTP transport mechanism where the Origin header is not validated. An attacker can leverage this via DNS rebinding when a user visits a malicious website while the pgEdge service is running locally on the same machine. This enables the attacker to interact with the server and read database schemas or query results from connected PostgreSQL databases. The default stdio transport method is not affected.

Impact

Successful exploitation allows unauthorized access to sensitive database schemas and query results. The impact is limited to the data accessible to the pgEdge Postgres MCP Server instance.

Recommendation

  • Upgrade the pgEdge Postgres MCP Server to version 1.1.0 or later immediately to apply the Origin header validation fix.
  • Audit environments for workstations running the pgEdge Postgres MCP Server with HTTP transport enabled.
  • If immediate patching is not possible, disable the HTTP transport and utilize the stdio transport exclusively.
]]>mediumadvisory