Daily Digest
The sole database-related vulnerability this cycle is a medium-severity authorization bypass in Tabularis 0.27.0 and earlier (CVE-2026-108604, CVSS 6.3), where prompt-injected agents or untrusted MCP clients can circumvent the read-only safety gate by issuing side-effecting `SELECT` statements (e.g., `setval`, `nextval`, or `query_to_xml` with embedded `DELETE`). No CISA KEV entries affect core PostgreSQL or major cloud database services today.
Summary: Tabularis through version 0.27.0 contains an incorrect authorization check in the MCP `run_query` safety gate. The gate classifies incoming SQL as read-only or read-write, but fails to detect side-effecting `SELECT` statements such as `SELECT setval(...)`, `SELECT nextval(...)`, or `SELECT query_to_xml(...)` with embedded `DELETE`. An attacker with access to an MCP client (or who can inject prompts into an agent using the MCP interface) can execute these statements to modify sequences or data without triggering the approval prompt. Exploitation requires network access to the Tabularis MCP endpoint and the ability to submit arbitrary SQL; no authentication bypass is described beyond the classification flaw.
Affected Features / Interoperability: The MCP (Model Context Protocol) `run_query` endpoint and its read-only classification logic. Downstream impact includes any AI agent or automated workflow that relies on Tabularis' MCP integration to enforce read-only access — sequence manipulation, data modification via XML functions, and potential further privilege escalation if modified sequences affect application logic.
Source:
Actions:
The single most urgent item this cycle is CVE-2026-105278, a CRITICAL (9.8) hardcoded administrative credential in the published Docker image for openPDC, referenced in CISA ICS Advisory ICSA-26-281-02. Because the credential is fixed and not forced to change on first use, any deployment of this image with a network-reachable management interface is immediately compromiseable by an unauthenticated attacker. While this is a container image issue rather than a Docker Engine patch, it requires immediate image rotation and credential hygiene across any healthcare or homelab deployments using openPDC. Separately, news coverage highlights credential leakage risks in AWS AgentCore and Anthropic's internal AI evaluation environment, which warrants attention to prompt injection and metadata token handling in cloud-native workloads.
Summary: The published Docker image for openPDC ships with a fixed administrative credential that is not forced to change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application. This is a container image vulnerability, not a Docker Engine defect.
Affected Features / Interoperability: openPDC container image and its management interface authentication. The raw data does not specify downstream integrations or interoperability impacts beyond the management interface.
Source:
Actions:
The following items are unverified community chatter and news mentions, separate from the Formal Vulnerabilities above.