pgEdge vulnerabilities
We track 4 vulnerabilities in pgEdge products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest pgEdge vulnerabilities
- 8.8 High severity
pgedge-postgres-mcp: Improper Neutralization of Special Elements used in an SQL Command
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An ar
- 8.1 High severity
pgedge-postgres-mcp: Improper Neutralization of Special Elements used in an SQL Command
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters,
- 7.5 High severity
pgedge-rag-server: Asymmetric Resource Consumption (Amplification)
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIM
- 7.8 High severity
control-plane: Missing Authentication for Critical Functionality
pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because P