The clock stops, but the chain doesn't. Just ask anyone running Postgres MCP Pro in "Restricted Mode" right now. They think they're safe. They are not. CVE-2026-85620 just shattered the illusion with a CVSS 9.2 and a whisper that started in a parser's blind spot, not in a noisy exploit.

The SQL-Borne Fracture

The vulnerability isn't elegant. It's worse—it's structural. The restricted mode was supposed to be the production-grade cage for AI agents poking at your PostgreSQL database. Read-only transactions. An allowlist. A parser called safe_sql.py that checks every SQL command. But the parser only guards one side of the fence.

Let me break down the technical truth: safe_sql.py checks the FuncCall AST node—that's where direct function calls like SELECT pg_read_file('/etc/passwd') get caught and blocked. But it never checks the RangeFunction node. That's the AST node for functions called inside the FROM clause. In plain English? An attacker doesn't need to call the function directly. They just hide it in the FROM filter. The payload becomes: SELECT * FROM pg_read_file('/etc/passwd'). That's it. That's the entire bypass.

Whispers before the ticker opens: this wasn't a sophisticated cryptographic breakout or a race condition. This is an engineering failure—an incomplete grammar tree that treats one form of function invocation as legal while missing the other. The restricted mode wasn't cracked; it was simply incomplete.

When Middleware Becomes a False God

Why should you care? Because the MCP ecosystem is no longer a playground of tinkerers. It hit 97 million monthly SDK downloads. It has over 10,000 live servers. And a sobering stat from a Department of Defense report: 28% of Fortune 500 companies are running this stack in production. The problem is clear: the MCP ecosystem's adoption speed is lapping its security maturity. Half of MCP builders say that managing security controls is the single hardest challenge they face.

I have spent years on trading floors where trust is measured in milliseconds. But here's the thing: in the AI-agent-to-database stack, trust isn't a matter of speed. It's a matter of inference boundaries. The entire security model of Postgres MCP Pro rested on the assumption that the application-layer allowlist would stand between an untrusted AI-generated SQL query and the raw data. I can tell you, based on my experience auditing transactional systems, that when you tie a security boundary to a single interpreter, you are one bug away from a data exfiltration event. The AST gap is that bug.

The Anatomy of the Fragile Cage

Let's reverse-engineer what actually happened. The attacker doesn't require authentication to the restricted logic itself. Any MCP client or AI agent that can reach the restricted mode can trigger the bypass. That means the vulnerability is exposed on three fronts. First, if you have a remote agent, it can pull sensitive configuration files from the host. The wildest concerns I have heard from operators in the IONIX Threat Center and VulnCheck databases aren't just about reading /etc/passwd. We're talking about credentials, TLS keys, and other system-level secrets.

Here's the second front, and this is the piece that gets downplayed in every hot take I've read: the so-called "read-only" transaction does not help you if the malicious read is delivered through a RangeFunction. The code path treats the FROM clause as a data access mechanism, not as a function executor. This is a design decision made by the parser's author that proved fatal. It turns the function call into a row source.

Third, there is a fundamental misalignment between database roles and the application layer. The official action advice hints at running the MCP server without pg_read_server_files permissions. But that is a mitigation, not a fix. The reality is that most operators will never even read that advisory. They will keep running version 0.3.0 or earlier, believing the restricted mode block is solid.

The Contrarian Angle: This Isn't Just Postgres MCP's Problem

Here's where I push back on the mainstream narrative. Everyone is pointing fingers at the crystaldba/postgres-mcp repository. The fix PR is in review. They'll patch the RangeFunction check, bump the version, assign a new CVE, and we'll all move on to the next exploit. But that is a complete misunderstanding of the danger. The actual threat vector is systemic across the AI infrastructure stack. Why do I say this? Because CVE-2026-85620 was disclosed within a three-week window alongside CVE-2026-82526 and CVE-2026-85695. Look at the spread: one covers retrieval, another covers model serving, and this third one hits database access. This is not a coincidence. This is a pattern. It is a cluster of failure that illustrates the immaturity of the entire AI application-layer security model.

Trust no one, verify everything, move fast. That phrase applies perfectly here, but with a twist: the builders of these MCP servers need to verify their own parsers before they ask us to verify the agents. The restricted mode was sold as a "production-grade configuration" to operators. But it was nothing more than a trust anchor that shifted the burden from the application to the database—and then let that same application bypass the database's own restrictions through a grammar trick.

What about other frameworks? I haven't audited LangChain or CrewAI database integrations, but I have been in this game long enough to know that the parser boundary issue is not exclusive to a single open-source repository. If I were a red team operator, I'd start pulling AST implementations from every mainstream AI agent framework and looking for the exact same disconnection between a security allowlist and the actual execution path. Liquidity flows where trust is liquid—but code flows where parsers are porous.

What the Adrenaline Hide

Let's talk about the emotional aspect of this threat. When I first saw this CVE, my heart rate spiked the same way it did in 2022 when I spotted the slashing rate anomaly during the Ethereum Merge. There's a thrill in finding the crack that others missed. But this isn't a game theory exercise. This is a practice that affects whether a Fortune 500 can maintain the confidence of its users. Staking is a promise, liquidity is the reality. In this context, the promise is "restricted mode equals safe." The reality, however, is that the trust layer sits on a single parser that can be fooled by swapping a direct call to a function into the FROM query clause.

The advisory signal from VulnCheck was blunt: Upgrade, do not rely on the restricted mode's controls until the new version is released. I see that as an acknowledgment that the CVE mechanism is not just a simple bug in an isolated project. It signals a potential regression in the standard of safety that we, as an industry, have slowly been building between AI agents and sensitive databases. If you want to find the next black swan, don't look at the latest algorithmic trading bot. Look at the intermediaries—the connectors, the APIs, the AST parsers that decide which code path gets executed.

The Road Ahead

Speed is the only currency that matters. That is why I am not waiting for the official patch announcement to draw my conclusions. The fix is expected within the next 6 to 8 weeks, but let me offer you the forward-looking question that matters more: How many other MCP connectors are going to get hit by similar CWE-863 Incorrect Authorization flaws before the operational playbooks catch up? The answer depends on whether we—as operators, auditors, and security researchers—start applying the lessons from this vulnerability across the board.

Here is my takeaway. Stop treating restricted modes as a security boundary and start treating them as a containment zone. You want to protect your data? The database role is the boundary. Your network access rules are the boundary. Your application-layer allowlist is merely a convenience, not a cage. The merge was just a dress rehearsal for the real challenges of agent-mediated data access. Now we are facing the true test: How do we ensure that the AI layer can validate its own SQL before the blockchain of trust becomes a cascade of leaks?