An OS command injection flaw exists in the read‑only enforcement of the SQL validation component of Amazon awslabs postgres‑MCP Server before version 1.1.7. By inserting a specially crafted COPY … TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read‑only mode, an unauthenticated actor can execute arbitrary operating system commands on the host running the self‑managed PostgreSQL server. Based on the description, it is inferred that the attacker builds the statement within data that the server validates, thereby bypassing the read‑only restriction. The vulnerability is a classic command injection (CWE‑78) and demonstrates a failure of read‑only enforcement (CWE‑184). It can compromise confidentiality, integrity, and availability if an attacker gains full control of the host.

AWS Labs postgres‑MCP Server versions prior to 1.1.7 deployed on self‑managed PostgreSQL servers are affected. The issue is resolved in 1.1.7 and newer releases. Users running earlier versions should plan an upgrade.

The CVSS score of 9 indicates a high severity flaw, but the EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is injecting the COPY … TO PROGRAM statement into data that the MCP server processes during a session. Based on the description, it is inferred that the attacker must feed a crafted statement to the MCP server’s SQL validator, which typically occurs when the server processes content from an authenticated session. Therefore, the risk is mitigated by enforcing strict authenticated access and network isolation, but the high CVSS suggests that once the attack vector is exposed, exploitation could lead to full system compromise.