CVE-2026-85620: Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function

Published Sep 4, 2026

Updated

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode protections.

Affected Software

1 affected component

Postgres MCP Pro Postgres MCP Pro=0.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Postgres MCP Pro to a version that resolves this vulnerability.
Fixed in 0.3.0Patch Restricted-Mode Bypass via FROM-Clause Function

Event History

Sep 4, 2026

CVE Published

via MITRE·02:32 PM

Data Sourced

via MITRE·02:32 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. An attacker must be able to submit SQL that is processed under Postgres MCP Pro's restricted mode.

Which restricted-mode queries can bypass the intended function validation?

Function calls represented as RangeFunction nodes in a SQL FROM clause are not subject to the function-name validation. This permits file-reading functions such as pg_read_file to be invoked through FROM-clause syntax.

What is the practical impact of successful exploitation?

An attacker can read arbitrary files despite restricted-mode protections. The provided scoring indicates high confidentiality impact, with no stated integrity or availability impact.