CVE-2026-108604: Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL querytoxml with embedded DELETE to modify data without approval prompts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An untrusted MCP client or a prompt-injected agent can exploit it when it can submit queries through the MCP run_query interface. Exploitation is local and requires user interaction according to the supplied vector.
Does read-only mode prevent data changes?
No. The affected safety gate classifies statements as safe based on their SELECT form, allowing side-effecting PostgreSQL expressions such as setval, nextval, or query_to_xml containing an embedded DELETE to execute without approval prompts.
What is the impact of a successful bypass?
An attacker may modify data despite read-only mode and without approval prompts. The supplied severity vector indicates integrity and availability impacts, with no confidentiality impact.