Where the Parser Stopped Looking: The AST Blind Spot That Broke Postgres MCP Pro's Restricted Mode

Two queries, separated by a single asterisk. The first, SELECT pg_read_file('/etc/passwd'), triggers every alarm in Postgres MCP Pro's restricted mode. The second, SELECT * FROM pg_read_file('/etc/passwd'), walks through the front door with the quiet confidence of a key that fits a lock nobody thought to inspect. Same function. Same outcome. Different route through a parser's blind spot. CVE-2026-85620 carries a CVSS score of 9.2, but severity scores flatten the geometry of failure. The truth hides in the differential between what the code intended to guard and what it actually observed. This is the silence I map between the code and the chaos: the gap between a security control's stated boundary and its enforced reality. For a decade, I have watched the crypto industry build settlement layers on the belief that the narrative is the only immutable ledger. But this vulnerability is not a narrative problem. It is a structural confession written in a parse tree. The restricted mode of Postgres MCP Pro was supposed to be the safe setting. The open-source Model Context Protocol server, maintained in the crystaldba/postgres-mcp repository, promised operators a deployment posture where an AI agent could query PostgreSQL without being able to destroy anything. The architecture seemed sound on paper: wrap every session in a read-only transaction, then run every generated query through an allowlist validator that strips or rejects dangerous function calls. Operators were told, in effect, that this was the production configuration. The threat model was clear enough: an AI agent, possibly confused by prompt injection or simply misaligned, generates SQL that must be contained. Restricted mode was the container. This matters more than most single-server vulnerabilities because of the ecosystem's velocity. The Model Context Protocol has become the lingua franca of AI tool access: 97 million SDK downloads per month, more than 10,000 active servers, and 28 percent of the Fortune 500 reportedly running MCP components in production. The U.S. Department of Defense has itself noted that MCP adoption is outpacing the maturity of its security models. That is a polite way of saying the industry is building skyscrapers while the safety standards are still calibrated for treehouses. Fifty percent of MCP server builders list the complexity of security controls as their single greatest challenge. I have seen this pattern before. In the ICO wild west of 2017, teams shipped smart contracts with the same optimism, trusting that audited code would protect unaudited expectations. The lessons of those burned bridges did not fully transfer to the AI stack. The core of this vulnerability deserves precise dissection, because precision is where the story actually lives. When PostgreSQL parses a query, it constructs an abstract syntax tree, an ordered map of every semantic element. Postgres MCP Pro's safe_sql.py walks that tree searching for function calls, specifically FuncCall nodes, and checks each one against an allowlist. This is the intended gate. The flaw is that a function call appearing in the FROM clause of a query is not represented as a FuncCall node at all. It is a RangeFunction node, a structurally distinct AST element. The validator, blind to this second form, simply never descends into it. So pg_read_file, an inherently dangerous function that reads server-side files, can hide inside the FROM clause of a SELECT statement, where the parser's guide dog walks past it without a sniff. Let me be precise about what this means in practice. An attacker who can reach a restricted-mode MCP endpoint, whether as a direct client or through a compromised AI agent's tool calls, can issue a query constructed to place dangerous functions in the unguarded AST position. The read-only transaction wrapper proves useless because reading is precisely the attack. The allowlist proves useless because the validator never sees the function it was built to reject. The result is arbitrary file read on the underlying server: system configuration files, stored credentials, TLS private keys, whatever the PostgreSQL process can access. And because the MCP server typically runs with the privileges of the application user, the blast radius is determined by whatever that operating system account can touch. The CVE record confirms that versions 0.3.0 and earlier are affected, and that exploitation requires no authentication beyond access to the restricted-mode interface itself. Classification matters here. Both IONIX Threat Center and VulnCheck have categorized this as CWE-863, Incorrect Authorization. That label is accurate but incomplete. This is not a case where authorization logic made a wrong decision. This is a case where authorization logic never knew a decision was required. The parser's coverage was incomplete in a way that no amount of allowlist hygiene could have caught, because the allowlist's enforcement point was scoped too narrowly from the first line of code. It is a systematic parser incompleteness risk, the kind that suggests the module's security logic was written against examples rather than against the full grammar of PostgreSQL. The timing amplifies the concern. Within a three-week window, the security research community disclosed CVE-2026-82526, CVE-2026-85695, and now CVE-2026-85620, a cluster covering retrieval infrastructure, model serving layers, and database access. That these vulnerabilities surfaced in the open source ecosystem is uncomfortable for the industry's self-image. But here is the contrarian truth that most commentary will miss: this public disclosure is the system working. Open source vulnerabilities are visible, reproducible, and patchable within weeks. A fix PR is already under review in the postgres-mcp repository. The far more disturbing possibility is that equivalent flaws exist across the proprietary AI agent frameworks that nobody audits, in closed database integration layers where LangChain tool calls and CrewAI database helpers wrap SQL generation behind terms of service instead of diffable code. Based on my audit experience across both DeFi protocol security reviews and AI middleware assessments, I can tell you that the density of these bolt-on validation layers is highest exactly where visibility is lowest. The deeper architectural lesson, though, points away from blaming the parser and toward reconsidering the entire trust model. Application-layer SQL validation is a probabilistic discipline applied to a deterministic problem. SQL grammar is extraordinarily expressive, AST structures are deeply nested, and the attack surface of a database's function library is wide. Any system that relies on a middleware component inspecting queries after an AI agent generates them will, eventually, encounter a node type it forgot to check. This is the fundamental category error: treating a validation routine as a security boundary. Boundaries are structural. Validation is aspirational. The restricted mode of Postgres MCP Pro gave operators a feeling of safety precisely because it was labeled restricted. In reality, it was a false boundary, deployed across production environments where the label substituted for the property. This is where my own history in the bear market trenches colors my reading of events. During the winter of 2022, after watching the Terra collapse and the cascade of lender failures, I spent six weeks in deliberate isolation working through why the industry's trust models kept failing. The conclusion I reached then still anchors my analysis now: infrastructure designed around a single control point will always fail at that point. The projects that survived did not rely on one clever mechanism. They layered database-level permissions, network-level isolation, and conservative defaults into a defense that held because no single component was essential. The same reasoning applies to AI database access. The correct fix for this vulnerability class is not a more complete AST walker, though that patch is necessary. The correct fix is to run MCP servers under PostgreSQL roles that lack pg_read_server_files and related privileges, so that even a fully compromised validator cannot elevate the server's reach. It means treating the database's own permission model as the primary boundary and the application-layer validator as a convenience, not a moat. The industry will, predictably, respond to CVE-2026-85620 with a cycle of hotfixes and blog posts. But I hunt for the story that the data cannot speak, and the data here is whispering something uncomfortable about the trajectory of AI infrastructure. For three weeks we have watched CVEs ripple through the AI stack's foundational layers, and each one has revealed the same pattern: controls bolted onto systems designed before autonomous agents existed. The MCP ecosystem's growth has been nothing short of astonishing, but growth rates do not confer safety. The Department of Defense flagged this exact mismatch, and the market responded with adoption momentum rather than caution. As someone who has spent recent years analyzing the convergence of AI agents and blockchain infrastructure, I find a painful irony in this moment. The crypto industry spent fifteen years building on the mantra of trustless execution, designing systems where no single party, human or machine, could act beyond defined privileges. Smart contract platforms enforce boundaries in the settlement layer by construction; the code either executes within its gas and state limits or it does not execute at all. AI infrastructure has inverted that philosophy. It trusts the agent, validates the tail, and hopes the middleware catches the lie. We are now feeding millions of monthly SDK downloads through security models that were not designed for entities that can be redirected by a single adversarial sentence hidden inside retrieved context. What comes next is a narrative shift that will feel familiar to anyone who watched DeFi mature after its own summer of reckoning. The security conversation around MCP will move from merely listing vulnerabilities to hardening the seams between agent reasoning and database authority. I expect to see hybrid architectures emerge in which the database enforces row-level security, functions execute under least-privilege roles, and the agent operates in a network enclave where even a worst-case prompt injection yields only the permissions of a carefully hobbled principal. In the wild west of AI agents, stories are the only compass, but this particular story is best read as a warning about the difference between a label and a load-bearing wall. The executives who deployed restricted mode believing they had checked the compliance box will have to explain why their trust model depended on a parser that stopped looking at the first node type. The builders will patch, and the researchers will move to the next server in the registry. But the ones who learn the architectural lesson will be those who understand that in systems mediating autonomous action, the boundary must be physical, persistent, and indifferent to the quality of any single parser. In a bear market, survival matters more than gains; in an AI security landscape defined by false boundaries, the same logic applies to data. The assets that survive are those whose safety was engineered into the architecture, not asserted in a configuration file.