Vulnerability Bulletins |
CVE-2026-108604 |
|
| Affected software | POSTGRESQL |
| Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-108604 | |