CVE-2026-85620

Name of the Vulnerable Software and Affected Versions Postgres MCP Pro version 0.3.0

Description A restricted-mode bypass exists where function-name validation is not applied to RangeFunction nodes within FROM clauses. This allows attackers to bypass the allowlist and execute file-reading functions, such as pg read file(), to read arbitrary files from the host system despite restricted-mode protections.

Recommendations Drop file-read rights from the database role to enforce security via DB role privileges rather than application-layer checks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.