CVE-2026-85620 Exposes Critical AST Parser Gap in Postgres MCP Pro Restricted Mode: Security Flaw Threatens AI Agent Database Interactions and Raises Red Flags for Crypto Infrastructure

The parser didn't cover the full picture. In the early hours of disclosure, the crystaldba/postgres-mcp open source repository dropped a module-level defect that turned what was supposed to be a production read-only boundary into an arbitrary file read vector. CVE-2026-85620 carries a CVSS score of 9.2 and flies under the radar until a single RangeFunction node slips through the net. Safe_sql.py only inspects FuncCall nodes for allowlist validation, leaving the FROM clause function calls untouched. A query like SELECT * FROM pg_read_file('/etc/passwd') bypasses every guardrail with zero authentication, granting full file system access to any MCP client or AI agent that can reach the server. Over the past 72 hours the MCP ecosystem has been flooded with traffic as analysts cross-reference the on-chain metadata, wallet clusters, and repository commits. The vulnerability is not an architectural innovation failure but a textbook engineering control gap that sits at the intersection of AI agent middleware and database query parsing. What makes this event seismic is the deployment context: restricted mode was marketed as a safe configuration for operators running production workloads, yet it is now treated as the primary defense line by 28 percent of Fortune 500 deployments and sits inside a protocol that has already crossed 97 million monthly SDK downloads. This is not isolated. Three weeks ago the same project surfaced three additional CVEs covering retrieval, model service, and now database access, painting a full-stack picture of trust model collapse. The defense department noted explicitly that MCP spread outpaced security model maturity. Fifty percent of MCP server builders list security complexity as their top challenge. The whale didn't blink; the ledger did not. The chart lied, and the data leaked. Context. MCP, the Model Context Protocol, emerged as an open standard enabling AI agents to call external tools without custom integration code. PostgreSQL sits at the heart of the database tier because its rich type system and mature query engine make it ideal for structured data retrieval. The Postgres MCP Pro variant adds a restricted mode wrapper that enforces read-only transactions and performs static AST validation before any statement reaches the underlying PostgreSQL instance. The intent was clear: give operators a false sense of perimeter security that they could rely on while the agent layer handled generation and execution. The design goal was to contain damage even if the agent prompt was compromised. Yet the AST implementation in safe_sql.py stops at FuncCall. FuncCall nodes capture direct scalar function calls inside the SELECT list or WHERE clause. RangeFunction nodes, however, represent the FROM clause syntax where functions appear as table functions or system functions such as pg_read_file or pg_ls_dir. This node type was never wired into the allowlist checker. The parser walks the tree, collects only the allowed FuncCall leaves, and accepts the rest. Because the RangeFunction is not traversed for validation, every form of function call in the FROM position becomes an open door. The bypass is trivial. An attacker sends a single statement that lands in the RangeFunction branch. The server executes it because the parser never saw the disallowed function. No session ID, no credential, no token needed. The restricted logic itself is never invoked; the AST check is bypassed before the permission layer is even consulted. All versions through 0.3.0 are affected. The fix PR (crystaldba/postgres-mcp) sits in review with no ETA beyond six to eight weeks. Production operators were told the configuration was ready for use; the code was not.