Description

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg_read_file through FROM-clause syntax to read arbitrary files despite restricted-mode protections.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-04T15:17:42.150Z",
  "pubdate": "2026-09-04T15:17:42.150Z",
  "executiveSummary": "Postgres MCP Pro 0.3.0 is susceptible to a restricted-mode bypass vulnerability stemming from insufficient input validation within the query parsing logic.\nThe vulnerability is classified as a security control bypass, which permits unauthorized execution of restricted PostgreSQL functions.\nSpecifically, the system fails to apply function-name allow-listing to RangeFunction nodes located within FROM clauses. This architectural oversight enables unprivileged or restricted users to invoke sensitive functions, such as pg_read_file, which are otherwise prohibited by the security policy.\nThe impact of this flaw is critical, as it grants an attacker the capability to perform arbitrary file reads from the underlying server filesystem with the privileges of the database process.\nExploitation requires the ability to submit SQL queries to the affected Postgres MCP Pro interface. The vulnerability bypasses the intended boundary of the restricted mode, effectively elevating the attacker's capabilities beyond the defined security constraints. This exposure poses significant risks, including the potential for exfiltration of sensitive configuration files, credentials, and system data, potentially leading to full system compromise.",
  "technicalDetails": "The root cause of this vulnerability lies in an incomplete implementation of the function-name validation mechanism within the Postgres MCP Pro 0.3.0 query processing engine. While the security layer correctly identifies and blocks unauthorized functions in standard command positions, it fails to sanitize or validate function calls encapsulated within RangeFunction nodes that appear in the FROM clause of a SQL statement.\nIn PostgreSQL, a RangeFunction allows a set-returning function to be used as a relation in the FROM clause (e.g., SELECT * FROM pg_read_file(...)). Because the parser does not perform a recursive or structural audit of these specific nodes during the initial security enforcement phase, the restricted-mode validation is bypassed entirely.\nThe attack flow follows a specific path: An attacker constructs a malicious SQL query leveraging table-valued function syntax. By placing a sensitive function like pg_read_file within the FROM clause, the attacker bypasses the gatekeeping logic that would typically trigger an error when invoked in a SELECT list or other restricted contexts. The query processor interprets the RangeFunction node as a valid data source rather than a restricted execution request.\nOnce the query is parsed and executed, the PostgreSQL backend processes the function call as a legitimate set-returning operation. Consequently, the database retrieves the requested file content as a result set. The vulnerability is effective because the security layer is focused on command-level blocking rather than deep-tree validation of the Abstract Syntax Tree (AST).\nAffected components include the query parser and validation logic of Postgres MCP Pro 0.3.0. There is no requirement for high-level database privileges to initiate this attack; any user with query submission rights can exploit this bypass. Post-exploitation impact is severe, as it facilitates the retrieval of arbitrary files accessible by the database process user, including /etc/passwd, configuration files containing API keys, or database dump files, depending on OS-level file permissions."
}