CVE-2026-125321

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client addre...

CVE-2026-125321 pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client addre...

EUVD-2026-121396

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client addre...

CVE-2026-125321

The pgEdge Postgres MCP Server (prior to version 1.1.0 ) is vulnerable to login rate limiting evasion due to improper handling of the X-Forwarded-For header. The ExtractIPAddress function in internal/auth/middleware.go used the leftmost caller-supplied value to determine the client address for Is...