Skip to content
OpenAdvisories

Vendor

pgEdge

13 known vulnerabilities.

Products

pgedge-postgres-mcp 7 pgedge-rag-server 3 control-plane 1 pgedge-go-llm-lib 1 Spock 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-126197

    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible c…

    pgEdge pgedge-postgres-mcp
  • High 8.1
    CVE-2026-126196

    pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database

    pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters…

    pgEdge pgedge-postgres-mcp
  • High 7.5
    CVE-2026-125327

    pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests

    pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LI…

    pgEdge pgedge-rag-server github.com/pgEdge/pgedge-rag-server Go
  • High 7.8
    CVE-2026-125323

    pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections

    pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because …

    pgEdge control-plane github.com/pgEdge/control-plane Go