CVE-2026-108604

Tabularis versions through 0.27.0 are vulnerable to an incorrect authorization vulnerability in the MCP run_query safety gate . This flaw allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Specifically, attackers can exe...