CVE-2026-87911: AWS Postgres MCP Server Lets COPY TO PROGRAM Reach the Host in Default Read Only Mode

Date: 2026-09-11
Tags: mcp-security

Executive Summary

Amazon published bulletin 2026-104-AWS on 2026-09-09 for CVE-2026-87911 in awslabs.postgres-mcp-server before 1.1.7. Incomplete SQL validation in the read only path can let a COPY TO PROGRAM statement run operating system commands on a self managed PostgreSQL host when an authenticated user later interacts with the MCP server. Amazon scored it 9.6 on CVSS 3.1. Upgrade to 1.1.7 or later, currently 1.2.1 on PyPI as of 2026-09-08 uploads, and connect the MCP server with a role that cannot use superuser or pg_execute_server_program.

Campaign Summary

Field	Detail
Campaign / Malware	CVE-2026-87911 in Amazon awslabs postgres-mcp-server. Vulnerability disclosure, no in the wild campaign named
Actor / Attribution	None. Researchers Mordehai Attia of Corsen AI and Ryan von Brubeck credited by AWS. Confidence none
Target	Self managed PostgreSQL deployments fronted by awslabs.postgres-mcp-server before 1.1.7, PG_WIRE_PROTOCOL, where the DB role can run COPY TO PROGRAM
Vector	Crafted COPY TO PROGRAM in content that the MCP server later processes in default read only mode
Status	Patched in 1.1.7. Same release also covered CVE-2026-85787, a lesser read only bypass disclosed 2026-09-04
First Observed	AWS bulletin 2026-09-09. NVD published the same day

Detailed Findings

According to Amazon, awslabs.postgres-mcp-server is the Python MCP server that connects a model to PostgreSQL. CVE-2026-87911 is an OS command injection weakness, CWE-78, plus incomplete denylist coverage, CWE-184, in the SQL validation that is supposed to keep default mode read only. Amazon said an unauthenticated actor might place a crafted COPY TO PROGRAM statement into content that is processed when an authenticated user uses the MCP server. Impact is limited to the self managed PostgreSQL profile using PG_WIRE_PROTOCOL, and to cases where the configured database role is superuser or holds pg_execute_server_program.

Amazon's resolution is version 1.1.7 on PyPI. Severity Daily reported that 1.1.7 is the same build AWS credited on 2026-09-04 for CVE-2026-85787, a 6.5 class incomplete denylist that allowed writes beyond read only scope, and that 1.2.1 was current on PyPI as of 2026-09-08. Severity Daily named GHSA-fph8-pg5w-78fv and said the patch adds COPY_PROGRAM_PATTERN in awslabs/postgres_mcp_server/mutable_sql_detector.py. Treat the AWS bulletin as the primary description; the GitHub advisory path is the vendor tracking link.

Amazon's workarounds are database side, not MCP side. Do not connect as superuser, rds_superuser, or the cluster master. For read only agent use, grant CONNECT, USAGE, and SELECT only, and force read only transactions on the role. AWS presented the role boundary as the control that still holds if a statement slips the application blocklist.

No in the wild exploitation, domain, IP, or hash was published. awslabs.postgres-mcp-server is an affected product, not a malicious package, so it is not added to the IOC feed.

MITRE ATT&CK Mapping

Technique	ID	Context
Exploit Public-Facing Application	T1190	Unauthenticated content can carry SQL that executes when a user drives the MCP server
Command and Scripting Interpreter: Unix Shell	T1059.004	COPY TO PROGRAM runs OS commands on the PostgreSQL host
Abuse Elevation Control Mechanism	T1548	Superuser or pg_execute_server_program roles make the statement host executing

IOCs

Domains

No domain IOCs published by source

Full URL Paths

No URL IOCs published by source

Splunk Format

No IOCs available for Splunk query

File Hashes

No hash IOCs published by source

Detection Recommendations

Inventory pip and container images for awslabs.postgres-mcp-server and pin to 1.1.7 or later. On PostgreSQL hosts used by MCP, alert on COPY TO PROGRAM in logs and on backend processes spawned by the postgres user that are not the usual utilities. Confirm the MCP role cannot use pg_execute_server_program and is not superuser. If you forked the server, carry the COPY_PROGRAM_PATTERN check from mutable_sql_detector.py. Hunt MCP sessions that process untrusted SQL from chat, tickets, or files, then immediately spawn shell from the database account.

References

[Amazon] Security Bulletin 2026-104-AWS, CVE-2026-87911 (2026-09-09): https://aws.amazon.com/security/security-bulletins/2026-104-aws/
[GitHub Advisory] GHSA-fph8-pg5w-78fv (2026-09-09): https://github.com/awslabs/mcp/security/advisories/GHSA-fph8-pg5w-78fv
[Severity Daily] AWS discloses a 9.6 RCE in its Postgres MCP server, fixed by the same release as last week's 6.5 (2026-09-09): https://severitydaily.com/aws-postgres-mcp-cve-2026-87911-copy-to-program-same-1-1-7-fix/