CVE-2026-108604

Published 10 October 2026 · tracked since 11 October 2026

Description

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, o

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-62050 CRITICAL 9.8
• CVE-2026-62051 CRITICAL 9.8
• CVE-2026-62052 CRITICAL 9.8
• CVE-2026-62053 CRITICAL 9.8
• CVE-2026-62035 MEDIUM 6.3
• CVE-2026-62021 HIGH 8.8
• CVE-2026-42719 CRITICAL 9.8
• CVE-2026-42723 CRITICAL 9.8
• CVE-2026-42716 CRITICAL 9.8
• CVE-2026-42718 CRITICAL 9.8

→ Open the live CVE board · all tools