A critical authorization bypass vulnerability in Postgres MCP Pro 0.3.0 allows unauthenticated attackers to read arbitrary files from the underlying system.

The software fails to apply function name validation to RangeFunction nodes within SQL FROM clauses. This allows an unauthenticated attacker to bypass restricted mode protections and execute sensitive functions, such as pg_read_file, to access arbitrary files on the host system.

The ability to read arbitrary files from the server represents a severe security compromise. An attacker could extract sensitive configuration files, database credentials, or system information, leading to full system compromise or lateral movement within the network. With a CVSS score of 8.6, this vulnerability is classified as high severity, posing a significant risk to data confidentiality and integrity.

Immediate Action: As no official patch is currently available, users should restrict network access to the Postgres MCP service to trusted IP addresses only and disable the service if it is not business critical.

Proactive Monitoring: Review database and application logs for unusual queries involving the FROM clause, particularly those attempting to invoke file-related functions like pg_read_file or other sensitive system operations.

Compensating Controls: Deploy a Web Application Firewall or a database proxy layer capable of inspecting and filtering incoming SQL queries to block requests containing unauthorized function calls in unexpected contexts.

Public Exploit Available: Unknown.

Given the severity of this authorization bypass, organizations utilizing Postgres MCP Pro must prioritize the implementation of network-level access controls to limit exposure. Continue to monitor the vendor repository for the release of a security patch and apply it immediately upon availability. Treat this as a high-priority risk until a formal fix is verified and deployed.