SQL Validation Bypass in AWS Labs Postgres MCP Server

Technical Analysis

The MCP server exposes a SQL execution tool intended to restrict agents/users to read-only queries via a denylist-based validation filter. Because the denylist is incomplete, crafted SQL statements submitted through normal authenticated MCP interactions can bypass the filter and execute write/modify operations against the underlying Postgres database. The entry point is the tool-call content submitted by an authenticated MCP client (e.g., an LLM agent acting on user or attacker-influenced input), meaning the attacker does not need infrastructure access, only the ability to influence query content passed to the tool. This crosses the intended trust boundary between an agent restricted to read-only DB access and full read-write database privileges, potentially enabling data tampering, integrity loss, or downstream corruption of agent-consumed data.

Affected Systems

awslabs postgres-mcp-server; protocols: MCP

Detection Signatures

• Monitor MCP tool-call logs for SQL statements containing write-oriented keywords (INSERT, UPDATE, DELETE, ALTER, DROP, MERGE, TRUNCATE) submitted to a tool advertised as read-only.
• Alert on SQL payloads using comment obfuscation, encoding tricks, stacked queries, or case-variation/whitespace tricks designed to evade denylist keyword matching.
• Audit database write activity correlated with MCP server service accounts configured for read-only use cases.
• Review postgres-mcp-server version in deployment manifests; flag any instance below 1.1.7.

Remediation Steps

1. 1

   Upgrade postgres-mcp-server

   Update to version 1.1.7 or later, which fixes the incomplete SQL validation denylist.

2. 2

   Enforce database-level least privilege

   Do not rely solely on application-layer SQL filtering; configure the database role used by the MCP server with read-only grants (e.g., REVOKE INSERT/UPDATE/DELETE) so tool-layer validation bypasses cannot cause writes.

3. 3

   Use allowlist-based query validation

   Where possible, replace denylist keyword filtering with parameterized queries, query allowlists, or read-only transaction modes (e.g., SET TRANSACTION READ ONLY) enforced at the connection level.

4. 4

   Audit and monitor

   Enable query logging and alerting for unexpected write statements executed through the MCP server, and periodically review for anomalies.