The code didn't fail silently. It failed loudly, methodically, and in a place nobody thought to audit.
Three weeks. Three critical CVEs. The AI agent infrastructure stack is hemorrhaging vulnerabilities at a pace that should concern anyone who has deployed these systems in production. The latest entry: CVE-2026-85620, a CVSS 9.2 authentication bypass in Postgres MCP Pro's restricted mode that allows arbitrary file read through a single syntactic trick.
The vulnerability lives in the AST parser's blind spot—specifically in how safe_sql.py handles function calls. But the implications extend far beyond one PostgreSQL middleware project. This is about what happens when developers trust application-layer security controls to enforce boundaries that the control itself cannot see.
The Parser's Geometry Problem
Let me be precise about what the code actually does. In Postgres MCP Pro's restricted mode, the security model relies on two pillars: a read-only transaction wrapper and an allowlist check at the AST level. The allowlist verification happens in safe_sql.py, and it targets FuncCall nodes—the AST representation of function calls in SELECT, WHERE, and similar clauses.
But SQL is geometrically flexible. A function call can appear in multiple AST node types, and Postgres MCP Pro's parser only covers one of them.
The attack surface lives in FROM clauses. When you write SELECT * FROM pg_read_file('/etc/passwd'), the function call doesn't live in a FuncCall node. It lives in a RangeFunction node. The parser never reaches that branch. The allowlist check never fires. The read-only transaction wrapper doesn't help because pg_read_file is a built-in PostgreSQL function that operates within the transaction's visibility model—but the file system access happens outside it.
The code didn't miss this by accident. It missed it structurally. The AST traversal logic has a gap, and that gap has a geometry.
Tracing the Bleed Through the Gateway
I spent time tracing how this vulnerability propagates through the MCP ecosystem's trust architecture. The MCP protocol—Model Context Protocol—has become the de facto standard for AI agent tool use. According to data from Synvestable and Zuplo, the ecosystem now processes 97 million monthly SDK downloads, operates over 10,000 active servers, and has penetrated 28% of Fortune 500 production environments.
The restricted mode in Postgres MCP Pro was designed for exactly this production use case. The documentation describes it as a configuration for operators in production environments. The assumption: restricted mode plus read-only transactions creates a safe execution environment for untrusted AI-generated SQL.
That assumption is now invalidated.
The vulnerability requires zero authentication. Any MCP client or AI agent that can access the restricted mode endpoint can trigger the file read. No credentials needed. No privilege escalation required. The attack surface is the exposed endpoint itself.
History is a Merkle tree, not a narrative. The vulnerability disclosure shows: Postgres MCP Pro versions 0.3.0 and earlier are affected. A fix PR sits in crystaldba/postgres-mcp under review. No patch is available yet.
The Three-CVEs-in-Three-Weeks Pattern
CVE-2026-85620 is not isolated. It joins CVE-2026-82526 and CVE-2026-85695, disclosed within the same three-week window. These three vulnerabilities span retrieval, model serving, and database access—the full AI agent infrastructure stack.
The pattern suggests systemic risk, not isolated bugs. The IONIX Threat Center and VulnCheck both classify CVE-2026-85620 as CWE-863: Incorrect Authorization. The authorization model assumes that AST-level checking creates a security boundary. It doesn't. The boundary exists where the code checks, not where the attacker can reach.
A Defense Department document cited in industry analysis notes that MCP adoption is outpacing security model maturity. That observation, made before these three CVEs, now reads as understated.
What the Bulls Got Right (And Why It Doesn't Help)
The MCP ecosystem's growth metrics are real. The 97 million monthly SDK downloads represent genuine developer adoption. The Fortune 500 penetration indicates production deployment confidence. AI agents demonstrably improve database interaction workflows—faster query construction, natural language to SQL translation, reduced boilerplate.
The bulls are correct that the value proposition is sound. They're incorrect that the security model is ready for production.
Fifty percent of MCP server builders cite security control complexity as their biggest challenge, according to industry surveys. This is the cost of moving fast: the security controls get designed for the happy path, audited for the expected attack surface, and shipped. The geometrically unexpected paths—the RangeFunction node gap, the FROM clause traversal—remain invisible until someone with an adversarial mindset looks.
The Production Operator's Dilemma
If you're running Postgres MCP Pro in production today, the recommended actions are clear but uncomfortable. Remove the restricted mode assumption from your security architecture. Do not treat it as a safety boundary for untrusted AI-generated SQL. Run the MCP server with a PostgreSQL role that lacks pg_read_server_files permissions—hardening at the database layer, not the application layer.
Monitor for FROM clause function calls in query patterns. Specifically: pg_read_file, pg_ls_dir, pg_read_binary_file, and similar file system access functions. These are legitimate tools in the right context. They're catastrophic in the context of an exposed MCP endpoint.
The fix in the PR will presumably close the AST parser gap. Until it's merged, tested, and deployed, your production environment has an exploitable authorization bypass with CVSS 9.2 severity. That's not a theoretical risk. That's a documented, reproducible vulnerability with a known attack vector.
The Deeper Pattern
This vulnerability exposes a fundamental trust model problem in AI agent infrastructure. Application-layer security controls assume they can see the full attack surface. The MCP protocol creates a middleware layer between AI agents and databases. The restricted mode was designed to enforce safety at that middleware layer.
But the middleware layer has parsing logic. The parsing logic has gaps. The gaps have geometry. And an attacker who understands the geometry can move through the control at the seams.
The pattern repeats across the AI infrastructure stack. Retrieval systems assume their sanitization covers injection vectors. Model serving assumes their isolation covers prompt extraction. Database access assumes their allowlists cover AST manipulation. Each assumption holds until it doesn't.
Precision Is the Only Apology the Truth Accepts
The MCP ecosystem will survive CVE-2026-85620. Patches will ship. Best practices will update. The 97 million monthly downloads will continue.
But the underlying issue won't resolve with a single patch. The AI agent infrastructure stack is being deployed faster than its security controls are being audited. The three CVEs in three weeks are symptoms, not the disease.
The disease is the assumption that application-layer controls can enforce database-level authorization. That assumption is structural. It lives in the gap between what the code checks and what the attacker can reach.
For production operators: treat your database permissions as the only authoritative security boundary. Everything else is optimization. Optimize after you've secured the foundation.
For the MCP ecosystem: the adoption metrics are impressive. The security maturity metrics are not. Fix that gap before the next three CVEs drop.
The code will always have geometry. The question is whether we audit all of it, or only the parts that look dangerous.