CVE-2026-126196

The pgEdge Postgres MCP Server (prior to version 1.1.0 ) contains a vulnerability where the read_only mode can be bypassed via SQL statement smuggling through the query_database function. The root cause is that pgx Exec (without bind parameters) may select PostgreSQL's simple query protocol, allo...