Tabularis EUVD-2026-96430

Requires a Tabularis instance (≤0.27.0) using its MCP run_query feature with an AI agent or MCP client connected in read-only mode against a backend (PostgreSQL) that exposes side-effecting functions such as setval, nextval, or query_to_xml. Exploitation depends on the attacker either influencing the agent via prompt injection or acting as an untrusted/malicious MCP client, and on the user operating that agent (UI:P). Limiting factors: exploitation is local to the MCP channel (AV:L), not remote/network-facing; it only matters when read-only mode is relied upon as a safety control; and impact is confined to data integrity/availability on the connected database with no confidentiality exposure.

This is a moderate-severity authorization flaw (CVSS 4.0 base 5.8) whose real-world risk is tightly bounded by its preconditions rather than its impact. The vector CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H is internally consistent with the description: AV:L reflects that exploitation occurs through a locally-connected MCP client/agent rather than over the network, AT:P and UI:P capture the dependency on an AI agent processing attacker-influenced input (prompt injection) and a user operating that agent, and VI:H/VA:H with VC:N correctly captures a data-integrity/availability problem (unapproved DELETE/setval) with no confidentiality loss. PR:N indicates no authentication to the Tabularis MCP surface, but this is mitigated by AV:L and UI:P. No EPSS score, no CISA KEV listing, and no POC flag were provided in the input, so there is no signal of active or widespread exploitation; a public technical write-up (hackmd) and the exact vulnerable source lines are referenced, which lowers the bar for exploit development but does not by itself constitute confirmed exploit code. There is no SSVC decision data in the input. Net: this is a legitimate but situational issue - a priority only for environments actually running Tabularis with AI/MCP integration against writable databases, not a broad emergency. Note one tension to verify: the 'Authentication Bypass' tag conflicts with the actual weakness (CWE-863 incorrect authorization / read-only-mode bypass), which is an authorization control failure, not an authentication bypass.

A user runs Tabularis (≤0.27.0) with an AI agent over MCP in read-only mode against a PostgreSQL database. An attacker plants a prompt injection in data the agent ingests, or connects as an untrusted MCP client, and submits a statement that is classified as a benign SELECT but wraps a side-effecting function (e.g., query_to_xml containing a DELETE, or setval/nextval). The run_query safety gate approves it as read-only, so the write executes without the normal approval prompt. No public exploit code is identified at time of analysis, though a technical write-up and the vulnerable code lines are publicly referenced.