Postgres MCP Pro Restricted Mode AST Parser Flaw Enables CVE-2026-85620 Arbitrary File Read Bypass: A Forensic Teardown of AI Agent Security Gaps

The code in Postgres MCP Pro's safe_sql.py module is not broken; it is lying. While the restricted mode is marketed as a production-ready safety boundary enforcing read-only transactions through allowlist validation on AST nodes, the implementation falls short at the parser level. Specifically, the script only traverses and validates FuncCall nodes. It leaves RangeFunction nodes uncovered in the FROM clause of SQL statements. This module-level defect directly enables CVE-2026-85620, a critical vulnerability rated CVSS 9.2 that can be triggered by minimal syntax manipulation. An attacker needs no credentials or authentication on any accessible MCP client or AI agent simply to issue a query such as SELECT * FROM pg_read_file('/etc/passwd'). The result is full arbitrary file read access, potentially exposing system configurations, credential stores, TLS keys, and more. This is a textbook case of engineering-level security control failure rather than any architectural breakthrough in the MCP framework. The associated fix pull request remains under review, and all versions through 0.3.0 remain vulnerable. What follows is a complete forensic dissection of the root cause, the exploitation path, the broader industry implications, and the structural impossibilities hidden beneath the hype. I do not fix bugs; I reveal the truth you hid. Every security leak is a story of human greed when parser boundaries are left incomplete.