CVE-2026-107322: AWS Agent Plugin psql Command Injection

CVE-2026-107322 affected the optional psql helper in AWS's databases-on-aws agent plugin. Its input filter missed psql meta-commands; remote content could lead to host command execution only if an agent later passed the crafted value to that helper. Upgrade to 1.7.1 or later.^{[1], [2], [4]}

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H^{[1], [4]}

💡 Plain English Explainer (ELI5)

A database clerk checks a note for extra SQL statements but forgets that the database client has its own instruction language. A note from outside could reach that second interpreter only if the agent chose to hand it to the local helper. The fix rejects that client-command syntax before the helper runs.^{[1], [2]}

Core Concepts & Subsystem Terms

psql meta-command: A command interpreted by PostgreSQL's interactive client rather than by the database server. The helper must treat this client-side instruction language as a separate parsing boundary from SQL.^{[2], [3]}
CWE-184: incomplete list of disallowed inputs: A filter rejects some prohibited input forms but omits another form that the downstream component interprets with special meaning.^{[2], [4]}
Agent-ingested content: Content received by an AI agent from a remote or otherwise untrusted source. AWS does not specify the delivery mechanism for the crafted content in this advisory.^[1]
Local helper: The optional psql connection script that runs on the same host as the agent. Any operating-system command launched through it runs with the helper process's permissions.^{[1], [3]}

Framework mappings

CWE reference for the weakness described in this guide: CWE-184

Step-by-Step Attack Flow

Step 1

Untrusted content reaches an agent

AWS says a remote unauthenticated actor can supply crafted content that an agent ingests. The public advisory does not identify the content source or delivery workflow, so do not assume a particular prompt-injection path.^{[1], [2]}

Step 2

The agent passes a value to the optional helper

The vulnerable condition requires the agent to invoke the local psql connection helper with the crafted database-command value. Content ingestion by itself is not the documented execution trigger.^{[1], [3]}

Step 3

SQL checks miss the psql command language

The helper filters statement separators and SQL comments but fails to reject a remaining backslash. The psql client interprets backslash-prefixed meta-commands locally, outside the database server's SQL privilege model.^{[2], [3]}

Step 4

The helper rejects meta-command syntax before execution

The upstream fix checks for remaining backslashes before the prior SQL checks. Upgrade to 1.7.1 or later and verify the active plugin revision in each agent environment.^{[1], [2], [3]}

Root Cause Analysis

AWS and the maintainer trace CVE-2026-107322 to incomplete filtering in the optional databases-on-aws psql connection helper. Before the fix, validation removed single-quoted SQL literals from a working copy and rejected SQL statement separators and comments, but left backslashes that the psql client interprets as meta-command syntax. The fix rejects those remaining backslashes after literal handling and before the existing checks, closing the missed parser boundary.^{[1], [2], [3]}

Source Code: Flaw vs. Secure Implementation

The upstream fix rejects backslashes remaining after its existing single-quoted-literal removal, before the SQL checks and psql invocation. That closes the documented psql meta-command gap for this helper. This excerpt is intentionally limited to the changed validation boundary; it is not a general-purpose SQL parser, and its original single-quote handling has documented edge cases. For complex or untrusted query construction, avoid the optional shell helper and use the plugin's DSQL MCP server or manually reviewed SQL as AWS recommends. The process should also run with least privilege; that limits impact but does not replace upgrading.^{[2], [3]}

Source excerpt: plugins/databases-on-aws/scripts/psql-connect.sh — reduced excerpt of the --command filter

UNPATCHED FLAW

# Reduced excerpt: SQL-focused checks did not reject psql meta-command syntax.
stripped=$(echo "$COMMAND" | sed "s/'[^']*'//g")
if echo "$stripped" | grep -q ';'; then
  echo "Error: multiple SQL statements are not allowed." >&2
  exit 1
fi
if echo "$stripped" | grep -q -- '--'; then
  echo "Error: SQL comments are not allowed." >&2
  exit 1
fi
psql --command "$COMMAND"

HARDENED SECURE PATCH

# Reduced excerpt based on the upstream 1.7.1 fix.
stripped=$(echo "$COMMAND" | sed "s/'[^']*'//g")
if echo "$stripped" | grep -q '\\'; then
  echo "Error: psql meta-commands are not allowed." >&2
  exit 1
fi
if echo "$stripped" | grep -q ';'; then
  echo "Error: multiple SQL statements are not allowed." >&2
  exit 1
fi
if echo "$stripped" | grep -q -- '--'; then
  echo "Error: SQL comments are not allowed." >&2
  exit 1
fi
psql --command "$COMMAND"

Engineering & System Hardening Checklist

✓Upgrade databases-on-aws to 1.7.1 or later and verify that this revision is active in every agent environment; for pinned checkouts, use commit 8b13a503746a4ebb0402b936645163224058bde3 or later.^{[1], [2], [3]}
✓Until upgraded, disable the optional psql connection-helper path; use manually reviewed SQL or the DSQL MCP server instead.^[1]
✓Do not rely on SQL-only filtering when input reaches psql: account for the psql client's separate meta-command language before invoking it.^{[2], [3]}
✓Add regression tests asserting that rejected meta-command syntax stops before the psql subprocess starts; include ordinary supported SQL cases to detect unintended breakage.^[3]
✓Run the agent and helper as an unprivileged OS user with a dedicated IAM role limited to dsql:DbConnect and a scoped database role; avoid dsql:DbConnectAdmin for routine work.^[1]
✓If there is evidence the helper host was accessed inappropriately, follow AWS guidance to rotate or revoke credentials available to that process and review its database roles and IAM-to-database mappings.^{[1], [2]}

Sources

← AI Security Hub Directory →