CVE-2026-85620 Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function
Attackers can bypass restricted-mode protections in Postgres MCP Pro to read arbitrary files via FROM-clause function calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85620?
CVE-2026-85620 is a critical vulnerability in crystaldba postgres-mcp, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg_read_file through FROM-clause syntax to read arbitrary files despite restricted-mode protections.
Weakness: CWE-863
Which versions are affected by CVE-2026-85620?
How do I fix CVE-2026-85620?
No fix has been published for CVE-2026-85620 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85620 being exploited?
There is no known exploitation of CVE-2026-85620 in the wild and no public exploit code.
Sources
Also known as GHSA-cm87-gp55-7cgj.