External risk intelligence

Postgres MCP Pro Restricted Mode Bypass Allows Arbitrary File Reading

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-85620

The product is a Model Context Protocol (MCP) server for PostgreSQL, which acts as a bridge between LLM-based agents and database systems. While it may be exposed to facilitate agent access to data, it is typically deployed as a local or internal middleware component rather than a directly public-facing internet edge service.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Postgres MCP Pro, a component that bridges large language models with PostgreSQL databases. The issue allows unauthorized access to read sensitive files on the system, bypassing intended security restrictions, which could potentially expose confidential data.

Bypasses security to read system files.
Matters if sensitive data is stored or accessed.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

Attackers can bypass restricted-mode protections in Postgres MCP Pro by exploiting a validation flaw in FROM clauses. This allows them to execute file-reading functions, potentially accessing sensitive files on the server.

No authentication or special access required.
Bypassing validation in FROM clause syntax.
Arbitrary file reads, impacting confidentiality.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows an unauthenticated attacker to bypass restricted-mode protections in Postgres MCP Pro by exploiting improper validation of function names in FROM clauses. This could enable attackers to execute file-reading functions and access arbitrary files on the server, potentially exposing sensitive system information.

Arbitrary file contents could be exposed.
File read functions may be executed remotely.
Sensitive data disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Postgres MCP Pro affects its ability to properly validate function names within FROM clauses, potentially allowing unauthorized file reading. The first step is for the platform or infrastructure team responsible for managing Postgres MCP Pro to identify all instances of this software, assess their reachability from the network, and determine their business criticality. Once accountable owners are identified, a risk-based remediation plan can be developed, which may involve coordination with the vendor.

Platform or infrastructure teams own the issue.
Verify MCP Pro instances and network exposure.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Postgres MCP Pro?

Postgres MCP Pro is a Model Context Protocol server that enables Large Language Model agents to interact with PostgreSQL databases. It acts as a specialized bridge, allowing AI systems to query or manipulate database content as part of automated workflows.

How does this CVE-2026-85620 vulnerability work?

This flaw is a restricted-mode bypass, categorized as CWE-863 (Incorrect Authorization). The software fails to properly check function names when they appear inside FROM clauses in a SQL statement. Because the validation logic overlooks these specific nodes, an attacker can use syntax to call unauthorized functions, such as those that read local files, despite the tool's intended security controls.

Does this allow an attacker to run any SQL command?

No. The vulnerability specifically targets the function-name validation process within FROM clauses. While it allows an attacker to bypass restrictions to execute sensitive file-reading functions like pg_read_file, it does not necessarily grant full, unrestricted command execution across all SQL syntax or administrative operations.

Is my instance of Postgres MCP Pro at risk?

Risk depends on your deployment architecture. According to Halo Surface Signal, this software is typically used as local or internal middleware to help AI agents access database data. While it is not usually a direct internet-facing edge service, any instance reachable by an attacker who can send malicious requests to the MCP interface is a potential target.

What are the first steps to address this issue?

Infrastructure teams should first inventory all active instances of Postgres MCP Pro to understand where they are deployed. Next, evaluate the network reachability of these instances to determine if they are accessible to unauthorized entities. Finally, prioritize the most critical systems for protection while coordinating with the vendor for official security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.