AWS Security Digest·Week 37 of 2026·Sep 7-13, 2026·5 items
Five New AWS Bulletins, Led by a Postgres MCP Server RCE
No major breach this week, but a busy one for AWS security bulletins: five new CVEs, led by a critical OS command injection in postgres-mcp-server that turns its read-only safeguard into full command execution. Also patched: a mysql-mcp-server read-only bypass, an SSM Session Manager SSRF exposing temporary IAM credentials, an XXE in the AWS Advanced JDBC Wrapper, and a denial-of-service in the AWS SDK for Go v2.
In this issue2critical3medium
CVEs & Vulnerabilities
5 items
$ cat /var/reports/CVE_REPORT.txt
critical/CVE/
CVE-2026-87911: OS Command Injection in postgres-mcp-server's Read-Only Mode
A second, more severe vulnerability was patched in postgres-mcp-server within a week of the SQL-validation bypass fixed in W36: the read-only enforcement mechanism in its SQL validation component can be defeated with a crafted COPY ... TO PROGRAM statement. AWS's advisory describes this as potentially allowing an unauthenticated actor to execute operating system commands by placing the crafted statement into content that is later processed when an authenticated user interacts with the MCP server (running in its default read-only mode against a self-managed PostgreSQL deployment), provided the underlying database connection already has superuser or pg_execute_server_program privileges. AWS's own advisory recommends connecting with a minimal-privilege database role rather than a superuser account, which would close this specific path, since that role-level restriction is the real security boundary, not the read-only flag.
Affects awslabs.postgres-mcp-server before 1.1.7; fixed in 1.1.7. Credited to Mordehai Attia (Corsen AI) and Ryan von Brubeck via coordinated disclosure.
Affected
postgres-mcp-server < 1.1.7
Fixed In
postgres-mcp-server 1.1.7
MCP
medium/CVE/
CVE-2026-85788: Read-Only Bypass in mysql-mcp-server via SQL Comments
The read-only enforcement in awslabs.mysql-mcp-server could be bypassed using SQL inline comments, allowing statements the read-only check was designed to block to execute anyway. AWS describes read-only mode as a best-effort safeguard, not a security boundary, and recommends enforcing access through properly scoped database permissions instead. Does not affect AWS service confidentiality or integrity; the flaw exists in this self-managed, client-side tool.
Affects mysql-mcp-server through 1.0.21; fixed in 1.0.23. Credited to Jaeyoung Yun via coordinated disclosure.
Affected
mysql-mcp-server <= 1.0.21
Fixed In
mysql-mcp-server 1.0.23
MCP
critical/CVE/
CVE-2026-89049: SSRF in SSM Session Manager Port Forwarding Can Expose IAM Credentials
The Session Manager remote-host port forwarding feature in AWS Systems Manager Agent improperly validated equivalent address representations, letting an authenticated user with port-forwarding permissions bypass destination restrictions and reach link-local endpoints, potentially extracting temporary IAM credentials. As an interim mitigation, AWS recommends restricting the AWS-StartPortForwardingSessionToRemoteHost document via the ssm:StartSession IAM permission until patched.
Affects SSM Agent below 3.3.4851.0; fixed in 3.3.4851.0.
Affected
AWS Systems Manager Agent < 3.3.4851.0
Fixed In
AWS Systems Manager Agent 3.3.4851.0
Systems Manager
medium/CVE/
CVE-2026-18061: XXE in the AWS Advanced JDBC Wrapper Could Leak IAM Credentials
The RemoteQueryCachePlugin in the AWS Advanced JDBC Wrapper improperly restricted XML external entity references. When the plugin is enabled with a shared cache, an attacker with write access could place crafted XML in a cached column value; reading that value back as XML lets the wrapper's parser resolve external entities, potentially disclosing sensitive files readable by the application process, including stored database and IAM role credentials. The plugin is disabled by default.
Affects the JDBC Wrapper 3.3.0 through 4.2.0; fixed in 4.3.0.
Affected
AWS Advanced JDBC Wrapper 3.3.0-4.2.0
Fixed In
AWS Advanced JDBC Wrapper 4.3.0
JDBC
medium/CVE/
CVE-2026-89090: Denial of Service in the AWS SDK for Go v2 EventStream Decoder
A malformed EventStream response frame containing a header value type byte outside the valid range can cause the host process to terminate, a remotely triggerable denial-of-service in any application using the affected SDK to consume EventStream responses.
Affects AWS SDK for Go v2 versions prior to the 2026-03-23 release; fixed in the 2026-03-23 release and later.
Affected
AWS SDK for Go v2 < 2026-03-23 release
Fixed In
AWS SDK for Go v2 2026-03-23 release
AWS SDK for Go
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
postgres-mcp-server has now had two distinct vulnerabilities patched five days apart, a SQL-modification bypass on September 4 and a full OS command injection on September 9. If you run the Postgres or MySQL MCP servers from AWS Labs, treat "read-only mode" as a convenience label, not a security boundary, and enforce access at the database role level the way AWS itself now recommends.
Filed Under
postgres-mcp-servermysql-mcp-serverMCPSystems ManagerJDBCAWS SDK for GoIAM
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
