AWSAWS-2026-101
An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs...
UnratedCVE-2026-85787 · Published Sep 4, 2026 · updated Sep 9, 2026
Bulletin ID: 2026-101-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/04/2026 13:00 PM PDT Description: We have identified CVE-2026-85787, an incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server. Impacted versions: any pypi package version < 1.1.7 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
- Severity from
- no source yet
More AWS advisories
All AWS| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 4 | AWS log4j-cve-2021-44228-hotpatch: command injection High8.5Sep 4 | High8.5 | 1.3-9.amzn2 |
| Sep 4 | Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon...UnratedSep 4 | Unrated | No fix yet |
| Sep 4 | Unverified access point ownership in Amazon EFS CSI DriverUnratedSep 4 | Unrated | No fix yet |
| Sep 4 | Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-serverUnratedSep 4 | Unrated | No fix yet |
| Sep 3 | Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development...UnratedSep 3 | Unrated | No fix yet |
| Sep 3 | OS command injection in the Amazon CodeCatalyst blueprints SDKUnratedSep 3 | Unrated | No fix yet |