High 8.6Published Sep 4, 2026

CVE-2026-85620Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function

Updated under an hour ago (2026-10-19 06:10 UTC)

Does this affect you?

It affects crystaldba postgres-mcp. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for crystaldba postgres-mcp

Exploited in the last 30 days

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg_read_file through FROM-clause syntax to read arbitrary files despite restricted-mode protections.

CVSS: 8.6 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness (CWE): CWE-863
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Awaiting Analysis
Record last updated: Sep 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

crystaldba postgres-mcp crystaldba:postgres_mcp (from the name)	through 0.3.0	CNA record

References

https://github.com/crystaldba/postgres-mcp/issues/178issue-tracking
https://github.com/crystaldba/postgres-mcpproduct
https://github.com/crystaldba/postgres-mcp/blob/v0.3.0/src/postgres_mcp/sql/safe_sql.pytechnical-description
https://www.vulncheck.com/advisories/postgres-mcp-pro-0.3.0-restricted-mode-bypass-via-from-clause-functionthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.