CVE-2026-85620 (Postgres MCP Pro, CVSS 9.2) lets a restricted-mode query read arbitrary server files by placing a blocked function in a FROM clause instead of a SELECT list; no patch exists yet.
CVE-2026-85787 and CVE-2026-87911 (AWS Labs' awslabs.postgres-mcp-server) are both fixed in version 1.1.7; the second allows operating-system command execution via COPY ... TO PROGRAM, not just data
None of the three bypasses work against a PostgreSQL role that genuinely lacks the underlying privilege, so a dedicated least-privilege database role is the real security boundary, not the MCP