Loading story…
A design flaw in the Python-based Simple PSQL MCP Server lets users bypass its purported read-only mode because the control accepts any input beginning with SELECT. In PostgreSQL, SELECT statements can invoke functions and query system views, allowing an attacker using sufficiently privileged database credentials to expose database activity and configuration data, terminate or disrupt backend connections, or cause denial-of-service conditions.
The maintainer acknowledged the disclosure and noted that simple-psql-mcp is an educational starter template whose README warns of SQL-injection risk. Organizations deploying it should not treat keyword filtering as an authorization boundary: restrict the PostgreSQL role to least-privilege permissions and use an explicit allowlist of permitted queries or operations, rather than granting broadly privileged credentials to the MCP service.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A design-level weakness was reported in Simple PSQL MCP Server: its read-only check accepts queries solely when they begin with "SELECT," allowing potentially disruptive PostgreSQL functions and system views to be invoked if the configured database role has sufficient privileges. The maintainer reportedly acknowledged the issue and said the project is an educational template whose README warns about SQL-injection risks.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified SQL injection and improper-access-control weaknesses in Model Context Protocol (MCP) database servers that label interfaces as read-only by checking only whether submitted SQL begins with `SELECT`. In PostgreSQL, `SELECT` can call functions with side effects or administrative privileges; where multi-statement queries are allowed, attackers may also append additional commands. **CVE-2025-59333** affects ExecuteAutomation's `@executeautomation/database-server` npm package and is rated CVSS 8.1. An authenticated low-privilege user able to submit MCP queries could modify data through stored functions, retrieve data beyond intended scope under the service account's permissions, terminate database backends, or trigger expensive queries for denial of service. Organizations should not rely on SQL prefix filtering: enforce read-only database roles and transactions, restrict connections to allowlisted tables and functions, require single statements, use parameterized queries, and apply least-privilege permissions to MCP service accounts.
Sep 3, 2026
A **critical SQL injection flaw** tracked as `CVE-2026-17351` affects pgAdmin 4 and allows an authenticated remote attacker to induce the product's AI Assistant to bypass intended read-only database protections. The bug is an incomplete fix for `CVE-2026-12045` and arises from a parsing mismatch: pgAdmin validates LLM-generated SQL with `sqlparse`, while PostgreSQL interprets the same input differently, enabling a crafted payload to be seen as a single statement during validation but executed as multiple statements by the database. Public reporting says the issue affects pgAdmin 4 releases before `9.18`, including versions `9.13` through `9.16`, and a public proof of concept is reportedly available. By smuggling a `COMMIT` into the SQL stream, an attacker can escape the read-only transaction wrapper and regain write capability, potentially leading to unauthorized SQL execution, data modification, privilege escalation, security control bypass, and in some environments a return of arbitrary code execution risk through the same indirect prompt-injection path as the earlier bug. Researchers reported that a proposed mitigation using psycopg3 prepared execution failed under default pgAdmin settings because `prepare_threshold` remained unset, causing fallback to PostgreSQL's simple query protocol; the corrected fix forces `conn.prepare_threshold = 0` on the dedicated read-only connection so PostgreSQL rejects multi-statement input via the extended query protocol. Authorities recommend upgrading to the latest vendor patches immediately.
Aug 3, 2026
Security researchers have identified significant vulnerabilities in implementations of the Model Context Protocol (MCP), a standard developed by Anthropic to facilitate secure and standardized connections between large language models (LLMs) and external data sources or tools. One notable vulnerability involved Burp's MCP server, which exposed a localhost port without proper web origin validation, enabling DNS rebinding attacks that could turn a user's Burp installation into a remote SSRF engine. This flaw allowed attackers to hijack Burp’s MCP tools and access internal networks, and was responsibly disclosed and rewarded with a $2,000 bounty. In addition, prompt hijacking attacks have been demonstrated against MCP-based AI workflows, particularly when session ID management is insecure. Researchers from JFrog discovered that the oatpp-mcp implementation generated predictable session IDs, making it susceptible to session hijacking and prompt injection attacks. These vulnerabilities highlight the risks associated with insecure MCP server configurations and underscore the need for robust validation, session management, and defensive controls when deploying MCP in security-sensitive environments.
Jul 23, 2026