Postgres MCP Pro CVE-2026-85620

Requires that the target run Postgres MCP Pro 0.3.0 with restricted mode enabled (the very control being bypassed) and that the attacker can submit SQL query text to the MCP server, e.g. through an LLM agent exposed to untrusted input. The file-reading function (pg_read_file/pg_read_binary_file) must be invoked from a FROM clause as a RangeFunction rather than a SELECT target. Limiting factors: the PostgreSQL role used by the server must retain EXECUTE on those functions (default for superuser/pg_read_server_files members), and readable files are constrained to those accessible to the PostgreSQL service account; deployments that revoke these functions or that expose the MCP endpoint only to fully trusted callers are not practically exploitable.

The vendor CVSS 4.0 vector (9.2, AV:N/AC:L/PR:N/UI:N/VC:H/SC:H) reflects a network-reachable, low-complexity read of high-value data with a scope/subsequent-system impact on the underlying host filesystem, which is a credible characterization of a restricted-mode bypass. No EPSS score, KEV listing, or public PoC is present in the provided data, so this is a high-severity-by-design issue rather than a confirmed mass-exploited one; the risk is concentrated in deployments that actually rely on restricted mode to expose the MCP server to untrusted or semi-trusted input (for example, an LLM agent processing attacker-influenced prompts). The most important caveat is the trust model: PR:N is only fair if the query channel is meant to be reachable by low-privileged/untrusted callers - where restricted mode is used as the sole safety boundary, any operator, even a mid-sized municipal IT team running an internal agent, should treat this as urgent and stop trusting restricted mode until patched, whereas a purely single-tenant local deployment behind authentication faces lower exposure. Impact is read-only (VI/VA:N), so this is confidentiality-focused, not an integrity or availability event.

An attacker who can influence queries sent to a restricted-mode Postgres MCP Pro 0.3.0 server - for example via prompt injection against an LLM agent wired to the tool - submits 'SELECT * FROM pg_read_file('/etc/passwd')' or reads database credentials, .pgpass, or configuration files. Because RangeFunction nodes skip the allowlist check, the query executes and returns the file contents. No authenticated PostgreSQL session or user interaction beyond the query channel is required.