Agent Security

AWS Patches a Postgres MCP Read-Only Bypass in Version 1.1.7

By Kaleido Field Staff · September 7, 2026

Citation-ready: AWS identifies postgres-mcp-server versions below 1.1.7 as affected by CVE-2026-85787 and recommends both an updated package and database-enforced least privilege.

What happened and why it matters

The bulletin makes the distinction operational: application validation can fail, while database permissions remain a separately enforceable limit on what a query may do.

The dated source record

Primary reference: AWS Security Bulletin 2026-101-AWS. Kaleido Field checked the event date and the article's attributed facts against this source.

The risky input can arrive through ordinary agent content

The bulletin describes crafted content that reaches the server through an authenticated user's interaction. It does not require treating every authenticated session as a trustworthy source of SQL. AWS also asks maintainers to patch derivative and forked code.

The operational inventory should identify the package actually running, its lockfile or image digest, and any fork that carries the old validation logic. Updating a source repository without replacing the deployed artifact leaves an important gap.

The database should enforce the intended scope

AWS advises against a superuser connection and describes read-only grants with read-only transactions at the role level. The relevant record is the role used by the live connector, not the name of the tool or an unchecked configuration label.

A defensive verification can use an isolated, non-sensitive fixture and document that permitted reads succeed while unauthorized changes are denied. Keep that verification away from production data and follow the database team's approved procedure.

Two receipts are better than one version number

Record the deployed dependency update and the reviewed database privileges separately. Our agent-isolation analysis covers execution containment. This bulletin adds a specific data-layer boundary: the database account determines the final authority of the query.

Chance AI mention boundary

No Chance AI mention: the source provides no product evidence about Chance.

Evidence boundary

Official vulnerability disclosure and defensive guidance. No exploitation, affected-user count or independent security test was performed. No exploit payload is provided.