CVE-2026-85620: Postgres MCP Pro Auth Bypass Vulnerability

CVE-2026-85620 Overview

CVE-2026-85620 is an authorization bypass vulnerability in Postgres MCP Pro version 0.3.0. The flaw exists in the restricted-mode SQL validation logic, which fails to apply function-name checks against RangeFunction nodes in FROM clauses. Attackers can invoke privileged functions such as pg_read_file through FROM-clause syntax to read arbitrary files on the database host. The vulnerability is categorized under CWE-863: Incorrect Authorization and affects deployments that rely on restricted mode as a security boundary for the Model Context Protocol (MCP) server.

Critical Impact
Remote, unauthenticated attackers can bypass restricted-mode protections to read arbitrary files accessible to the PostgreSQL server process.

Affected Products

Postgres MCP Pro version 0.3.0
Deployments exposing the MCP server with restricted mode enabled
PostgreSQL instances accessible through the affected MCP interface

Discovery Timeline

2026-09-04 - CVE-2026-85620 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85620

Vulnerability Analysis

Postgres MCP Pro implements a restricted mode intended to block dangerous SQL constructs and privileged function calls. The validation logic in safe_sql.py inspects parsed SQL abstract syntax tree (AST) nodes to enforce a function allowlist. However, the enforcement path does not traverse RangeFunction nodes, which represent set-returning functions used inside a FROM clause.

An attacker can move a prohibited function call from the SELECT list into the FROM clause. The parser produces a RangeFunction node, which the validator ignores, and the query executes against the database. Functions such as pg_read_file and pg_read_binary_file become reachable, allowing arbitrary file reads within the PostgreSQL server's filesystem context.

Root Cause

The root cause is incomplete AST traversal during authorization checks. The safe-SQL validator enumerates function references in expression contexts but omits table-reference contexts. This gap between the parser's node model and the validator's coverage produces an inconsistent security boundary. See the safe_sql.py source in the vulnerable release and Issue #178 for the maintainer discussion.

Attack Vector

Exploitation requires network access to the Postgres MCP Pro interface and the ability to submit SQL statements through the MCP protocol. No authentication is required for the bypass itself when the MCP endpoint is reachable. An attacker submits a SELECT query whose FROM clause invokes a file-reading function through RangeFunction syntax, such as calling pg_read_file as a table source. The server passes the query to PostgreSQL, which executes the function and returns file contents to the caller. Refer to the VulnCheck advisory for a full technical write-up.

Detection Methods for CVE-2026-85620

Indicators of Compromise

PostgreSQL query logs containing pg_read_file, pg_read_binary_file, or pg_ls_dir invocations originating from the MCP service account.
SQL statements referencing privileged functions as table sources in FROM clauses rather than in SELECT expressions.
Unusual read access to files such as postgresql.conf, pg_hba.conf, or files under the PostgreSQL data directory.

Detection Strategies

Enable log_statement = 'all' on PostgreSQL and alert on any invocation of file-reading or directory-listing functions by the MCP database role.
Parse MCP request logs for SQL bodies containing FROM pg_read_file(, FROM pg_read_binary_file(, or FROM pg_ls_dir(.
Correlate MCP client identifiers with anomalous query patterns that reference system catalog paths.

Monitoring Recommendations

Monitor filesystem access on the PostgreSQL host for reads of configuration files, key material, and secrets from the postgres process.
Track the MCP service role for privilege changes and unexpected function usage over time.
Forward PostgreSQL and MCP application logs to a centralized analytics platform for retention and correlation.

How to Mitigate CVE-2026-85620

Immediate Actions Required

Restrict network exposure of the Postgres MCP Pro endpoint to trusted clients using firewall rules or a reverse proxy with authentication.
Revoke EXECUTE on pg_read_file, pg_read_binary_file, and pg_ls_dir from the PostgreSQL role used by the MCP service.
Rotate credentials and secrets that may have been exposed through readable configuration files.
Audit PostgreSQL query history for prior use of file-reading functions issued through FROM clauses.

Patch Information

No fixed version is listed in the NVD entry at publication time. Monitor the Postgres MCP GitHub repository and Issue #178 for an updated release that extends validator coverage to RangeFunction nodes.

Workarounds

Run the MCP service under a PostgreSQL role limited to a dedicated schema with no access to superuser-only functions.
Place the MCP endpoint behind an authenticating gateway and require per-user tokens for query submission.
Enforce a query allowlist at the application layer that rejects statements referencing pg_read_file, pg_read_binary_file, or pg_ls_dir in any clause.

bash

# Restrict the MCP database role from invoking file-reading functions
REVOKE EXECUTE ON FUNCTION pg_read_file(text) FROM mcp_role;
REVOKE EXECUTE ON FUNCTION pg_read_file(text, bigint, bigint) FROM mcp_role;
REVOKE EXECUTE ON FUNCTION pg_read_binary_file(text) FROM mcp_role;
REVOKE EXECUTE ON FUNCTION pg_ls_dir(text) FROM mcp_role;