Tabularis
Monthly
Read-only mode bypass in Tabularis through 0.27.0 lets prompt-injected AI agents or untrusted MCP clients execute data-modifying SQL that the run_query safety gate misclassifies as read-only, allowing side-effecting statements such as setval, nextval, or PostgreSQL query_to_xml with an embedded DELETE to alter or destroy data without triggering an approval prompt. The issue is a local, MCP-channel authorization flaw (assessed CVSS:3.1 AV:L/AC:L/PR:N/UI:R, C:N/I:H/A:H; CVSS 4.0 base 5.8) that only matters when read-only mode is relied upon as a security control against a backend exposing such functions, and the provided CVSS vector indicates no privileges are required (PR:N) while the operator still must interact with the agent (UI:P). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so risk is driven by preconditions-an exposed MCP run_query connection to PostgreSQL-rather than by active exploitation.
Read-only mode bypass in Tabularis through 0.27.0 lets prompt-injected AI agents or untrusted MCP clients execute data-modifying SQL that the run_query safety gate misclassifies as read-only, allowing side-effecting statements such as setval, nextval, or PostgreSQL query_to_xml with an embedded DELETE to alter or destroy data without triggering an approval prompt. The issue is a local, MCP-channel authorization flaw (assessed CVSS:3.1 AV:L/AC:L/PR:N/UI:R, C:N/I:H/A:H; CVSS 4.0 base 5.8) that only matters when read-only mode is relied upon as a security control against a backend exposing such functions, and the provided CVSS vector indicates no privileges are required (PR:N) while the operator still must interact with the agent (UI:P). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so risk is driven by preconditions-an exposed MCP run_query connection to PostgreSQL-rather than by active exploitation.