Executive brief
Postgres MCP Pro is a Python tool that provides managed SQL access to PostgreSQL databases with security controls. Version 0.3.0 contains a flaw that allows attackers to bypass file-reading restrictions by using SQL FROM-clause syntax to execute functions like pg_read_file, potentially exposing sensitive database files to unauthorized access.
Technical details
The vulnerability is a restricted-mode bypass (CWE-693) in the SQL validation logic. The tool's safe_sql.py module performs function-name validation on SQL queries to prevent execution of dangerous functions in restricted mode, but fails to apply this validation to RangeFunction nodes appearing in FROM clauses. An attacker can craft a SELECT query with a FROM clause containing pg_read_file() or similar file-reading functions to circumvent the intended security controls. The vulnerability is network-reachable if the MCP server is exposed, requiring only the ability to submit SQL queries through the tool's interface. No authentication bypass is needed if the service is already accessible. Patches are available in versions after 0.3.0.
Affected products
- Crystal DBA Postgres MCP Pro 0.3.0
Timeline
- 2026-09-04: disclosed: CVE-2026-85620 published