CVE-2026-126198

The pgEdge Postgres MCP Server (versions prior to 1.1.0 ) contains a vulnerability where bundled clients, including the CLI and web client , perform write operations without user confirmation. The root cause is that these clients only checked for the query_database tool name instead of honoring s...