CVE-2026-85620: Postgres MCP Pro's read-only mode is bypassed by moving the function into the FROM clause

NVD·high signalXBlueskyLinkedInCopy link

Rated CVSS 9.2, the flaw is that safe_sql.py checks function names only on FuncCall AST nodes, while a function in a FROM clause parses as a RangeFunction node the validator passes without inspecting. `SELECT pg_read_file('/etc/passwd')` is blocked but `SELECT * FROM pg_read_file('/etc/passwd')` returns the file. All versions through 0.3.0 are affected; the class of bug is an allowlist applied at one node type in a parser that has several.