AWS published security bulletin 2026-101 at 13:00 PDT on 4 September — 20:00 UTC, covering CVE-2026-85787 in awslabs.postgres-mcp-server. The text: "An incomplete list of disallowed inputs in the SQL validation component … might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server."
What is actually broken
Not the database, and not the model. The server's selling point is natural language to SQL against an Aurora instance, with writes gated behind an opt-in --allow_write_query flag. Read-only was implemented as a list of forbidden strings, and the list was incomplete. GitHub classes it CWE-184. The CVSS v4.0 vector is VC:N/VI:H — confidentiality untouched, integrity high — scoring 7.1, with CVSS v3.1 at 6.5.
Who the attacker is
"Unauthenticated actor" reads as someone hitting an exposed endpoint. The vector says otherwise: UI:P in v4.0, UI:R in v3.1. The attacker is unauthenticated because all they do is plant text somewhere the model will read; it is the authenticated user's own agent that submits the resulting SQL. This is indirect prompt injection with a database write as the payload, filed as a CVE — one of the first times that shape has been catalogued as a product vulnerability rather than a research finding.
What the received framing gets wrong
"Before version 1.1.7" implies a fresh patch. 1.1.7 was uploaded to PyPI on 25 June, 71 days before the bulletin, and the current release is 1.2.0. Anyone following the README's own install snippets, which pin nothing, was carried past the problem months ago without knowing there was one; anyone pinned to an older version has been exposed for ten weeks with no public advisory to act on. The same day AWS published a second MCP-server CVE — CVE-2026-85654 in dynamodb-mcp-server, CVSS 7.8, where a crafted table name in a data-model file becomes code on whichever host later runs cdk deploy.
The structural point
A safety property implemented as a blocklist of strings, in a component whose entire purpose is generating SQL from untrusted natural language, is the argument for enforcing privileges in the database rather than in a parser. AWS's own interim mitigation advice falls back to exactly that.