Postgres MCP Pro ships a feature called Safe Mode. The pitch is simple: let an AI agent talk to your database, but only let it run read-only queries. No DROP, no DELETE, no ALTER, no writes of any kind. It does this by parsing every incoming SQL statement and checking it against an allowlist before the statement ever touches Postgres.
CVE-2026-85620 says the parser has a flaw that lets crafted SQL slip past that allowlist entirely. An agent (or whoever's steering it, directly or via prompt injection) can construct a statement that the validator reads as safe but Postgres executes as something very much not safe.
Let's talk about why this class of bug is basically inevitable, and where the actual fix needs to live.
How Safe Mode Was Supposed to Work
The design is a classic gatekeeper pattern: intercept the query text, parse it, walk the resulting structure, check it against a set of permitted operations, then either forward it to Postgres or reject it. It's the same idea as a WAF rule that blocks UNION SELECT, or an input sanitizer that strips <script> tags.
