https://feed.craftedsignal.io/vendors/pgedge/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 18:59:54 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-pgedge-mcp-dns-rebinding/Tue, 10 Nov 2026 18:59:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pgedge-mcp-dns-rebinding/The pgEdge Postgres MCP Server prior to version 1.1.0 fails to validate the Origin header, enabling DNS rebinding attacks that allow an attacker-controlled web page to exfiltrate database schemas and query results.The pgEdge Postgres MCP Server (prior to version 1.1.0) contains a vulnerability in its HTTP transport mechanism where the Origin header is not validated. An attacker can leverage this via DNS rebinding when a user visits a malicious website while the pgEdge service is running locally on the same machine. This enables the attacker to interact with the server and read database schemas or query results from connected PostgreSQL databases. The default stdio transport method is not affected.

Impact

Successful exploitation allows unauthorized access to sensitive database schemas and query results. The impact is limited to the data accessible to the pgEdge Postgres MCP Server instance.

Recommendation

• Upgrade the pgEdge Postgres MCP Server to version 1.1.0 or later immediately to apply the Origin header validation fix.
• Audit environments for workstations running the pgEdge Postgres MCP Server with HTTP transport enabled.
• If immediate patching is not possible, disable the HTTP transport and utilize the stdio transport exclusively.

]]>mediumadvisoryhttps://feed.craftedsignal.io/briefs/2026-11-pgedge-mcp-rate-limit-evasion/Tue, 10 Nov 2026 18:59:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pgedge-mcp-rate-limit-evasion/pgEdge Postgres MCP Server versions prior to 1.1.0 contain a vulnerability where an attacker can bypass login rate limiting by manipulating the X-Forwarded-For HTTP header.pgEdge Postgres MCP Server versions prior to 1.1.0 contain a vulnerability (CVE-2026-125321) in the login rate limiting mechanism. The implementation relies on the leftmost value of the caller-supplied 'X-Forwarded-For' header to identify the client IP address. An attacker can manipulate this header to rotate perceived IP addresses, thereby evading rate limiting or exhausting the rate limit bucket of other users. This issue is reachable when the HTTP transport is enabled, especially if the deployment configuration appends rather than replaces the 'X-Forwarded-For' header.

Impact

Successful exploitation allows unauthenticated attackers to bypass login rate limits, facilitating brute-force or credential stuffing attacks against the Postgres MCP server.

Recommendation

• Upgrade pgEdge Postgres MCP Server to version 1.1.0 or later immediately.
• Review ingress and proxy configurations to ensure that 'X-Forwarded-For' headers are sanitized and correctly replaced by trusted upstream proxies before reaching the application.
• Audit logs for repeated login failures originating from diverse or suspicious 'X-Forwarded-For' header values.

]]>mediumadvisory