Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg_read_file through FROM-clause syntax to read arbitrary files despite restricted-mode protections.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-07 | 1 | Disclosure1 |
| 2026-09-08 | 2 | Disclosure2 |
| 2026-09-10 | 2 | Patch2 |
🚨 HIGH SEVERITY: CVE-2026-85620 (CVSS 8.6) Postgres MCP Pro 0.3.0 has a restricted-mode bypass allowing arbitrary file reads via pg_read_file in FROM clauses. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/7NWIB4uUJX
Post summary
CVE-2026-85620 is a high‑severity vulnerability in Postgres MCP Pro 0.3.0 that enables arbitrary file reads via a restricted‑mode bypass; a patch is urgently required.
@cr3ghost @ZephrFish The server count is less important than the trust boundary: Postgres MCP Pro CVE-2026-85620 remains unfixed (RangeFunction bypass), while AWS 85787 needs ≥1.1.7. Least-privilege DB role beats any MCP ‘read-only’ flag.
Post summary
The post highlights that Postgres MCP Pro’s CVE‑2026‑85620 remains unfixed, AWS’s CVE‑85787 requires patch ≥1.1.7, and recommends using a least‑privilege DB role over MCP read‑only flags to mitigate the risk.
News: CVE-2026-85620 in Postgres MCP Pro (CVSS 9.2) bypasses restricted mode and can read host files. Hits AI agents on Postgres. No patch past 0.3.0; drop file-read rights from the DB role. https://forkast.news/postgres-mcp-pro-restricted-mode-bypass-exposes-the-gap-in-ai-database-security/
Post summary
The article announces CVE-2026-85620 in Postgres MCP Pro, a CVSS 9.2 vulnerability that bypasses restricted mode and allows host‑file read access, noting that versions beyond 0.3.0 lack a patch and recommending removal of file‑read rights from the DB role.
CVE-2026-85620: When Your MCP Server's Allowlist Parser Isn't the One Actually Parsing SQL — by Cor E #AI #MCP #cybersecurity #DEVCommunity #devops https://dev.to/coridev/cve-2026-85620-when-your-mcp-servers-allowlist-parser-isnt-the-one-actually-parsing-sql-13de
Post summary
The post announces the existence of CVE‑2026‑85620, indicating a flaw in an MCP server’s allowlist parser, but offers no PoC, exploit, patch, or technical depth.
Postgres MCP Pro restricted mode blocks dangerous SQL for AI agents. CVE-2026-85620 (CVSS 9.2): a FROM-clause call bypasses the allowlist, leaking host files via pg_read_file. Enforce via DB role privileges, not app-layer checks. https://www.ionix.io/threat-center/cve-2026-85620/
Post summary
A PostgreSQL vulnerability (CVE‑2026‑85620) allows a FROM‑clause bypass to read host files; mitigation involves enforcing DB role privileges, with no mention of PoC, exploit tool, or active exploitation.