Summary
Postgres MCP Pro version 0.3.0 contains a critical restricted-mode bypass (CVE-2026-85620) that allows unauthenticated attackers to read arbitrary files from the database host. The flaw is caused by an incomplete SQL validation in the Abstract Syntax Tree parser, enabling the execution of dangerous functions through FROM clauses.
Take Action:
If you're running Crystal DBA's Postgres MCP Pro (version 0.3.0 or earlier), don't rely on its restricted mode to keep your AI agents in check. It can be bypassed to read files off your server, including passwords and private keys. Change the database account the MCP server uses to a least-privilege role, strip its superuser status and pg_read_server_files permission, and keep it off the internet until an official fix ships.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)