Check out the latest research from IONIX: NEW! State of the WAF Report

Back
New CVE Detected

CVE-2026-85620 – Restricted-Mode Bypass / Arbitrary File Read – Postgres MCP Pro ≤ 0.3.0

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-85620 is a critical incorrect-authorization vulnerability (CWE-863) in Postgres MCP Pro (the postgres-mcp PyPI package by crystaldba), a Model Context Protocol server that lets AI agents query and manage PostgreSQL databases. The flaw allows an attacker to bypass the tool’s "restricted mode" (read-only) protections and execute privileged, file-reading PostgreSQL functions such as pg_read_file(), exposing arbitrary files on the database host. The issue carries a CVSS v4.0 base score of 9.2 (Critical) and affects all versions up to and including 0.3.0.

Technical details

  • Root cause: Postgres MCP Pro’s SQL safety layer validates function calls only when they appear as FuncCall AST nodes. Functions invoked in a FROM clause parse instead as RangeFunction nodes; these nodes are present in the tool’s ALLOWED_NODE_TYPES list but are never checked against the ALLOWED_FUNCTIONS allowlist (see safe_sql.py).
  • Trigger conditions: An MCP client (or an AI agent acting on attacker-influenced input) with access to the server’s restricted/read-only mode submits a query that places a normally-blocked function in the FROM clause instead of a standard function call, e.g. SELECT * FROM pg_read_file('/etc/passwd') — which succeeds — versus SELECT pg_read_file('/etc/passwd'), which is correctly blocked.
  • Attack vector: Network — any party able to send SQL through the MCP server’s restricted-mode interface (e.g., via an AI agent, chat interface, or direct MCP client connection) can exploit the flaw without authentication to the underlying restriction logic itself.
  • Impact: Disclosure of arbitrary files readable by the PostgreSQL server process (e.g., /etc/passwd, configuration files, credentials, TLS keys), and potential exposure of other sensitive host data via functions like pg_ls_dir() and pg_stat_file(). The vulnerability affects confidentiality only (no direct impact on integrity or availability of the database), but the impact scope can extend beyond the vulnerable component to the underlying host filesystem.

Affected software

  • crystaldba postgres-mcp (Postgres MCP Pro), PyPI package — versions 0 through 0.3.0 (all releases up to and including 0.3.0)

Severity

  • CVSS v4.0: 9.2 (Critical) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
  • CVSS v3.1: 8.6 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
  • CWE-863: Incorrect Authorization

Mitigation and recommended actions

  • Immediate: As of this writing, no patched release beyond 0.3.0 has been published by the vendor; a fix is under review in an open pull request against the project’s repository. Security teams should monitor the crystaldba/postgres-mcp repository for a patched release and upgrade as soon as one is available.
  • If no patch is available:
    • Restrict or disable "restricted mode" reliance for untrusted or AI-agent-driven query paths until a fix is released; do not treat restricted mode as a strong security boundary against arbitrary SQL input.
    • Run Postgres MCP Pro against a PostgreSQL role that lacks pg_read_server_files (and other file-access-granting) privileges, so that even if the bypass is exploited, the underlying database role cannot read arbitrary host files.
    • Apply network-level restrictions limiting which clients/agents can reach the MCP server, and monitor logs for queries using pg_read_file, pg_ls_dir, pg_stat_file, or other filesystem functions invoked via FROM-clause syntax.
    • Avoid exposing Postgres MCP Pro instances directly to untrusted networks or unvetted AI agent prompts until the underlying validation gap is closed.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge