Restricted-Mode Bypass in Postgres MCP Pro by Crystal DBA
CVE-2026-85620

9.2CRITICAL

Key Information:

Vendor

Crystaldba

Status
Postgres-mcp
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85620?

Postgres MCP Pro version 0.3.0 has a vulnerability that allows attackers to bypass restricted-mode protections. Specifically, it fails to validate function names within RangeFunction nodes in FROM clauses. This oversight enables malicious actors to execute file-reading functions such as pg_read_file, giving them the capability to access and read arbitrary files on the server. Users of this product should review their configurations and apply necessary patches to mitigate this security risk.

Affected Version(s)

postgres-mcp 0 <= 0.3.0

References

https://github.com/crystaldba/postgres-mcp/issues/178
issue-tracking
https://github.com/crystaldba/postgres-mcp
product
https://github.com/crystaldba/postgres-mcp/blob/v0.3.0/sr...
technical-description

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.