Tabularis through 0.27.0 contains an incorrect authorization flaw in the MCP run_query safety gate, a CWE‑863 weakness. Prompt‑injected agents or untrusted MCP clients can send side‑effecting SELECT statements, such as SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE commands. This allows an attacker to modify database contents without triggering the usual approval prompts, effectively bypassing the read‑only restriction and raising the impact to data integrity violations.

The vulnerability affects the TabularisDB Tabularis product version 0.27.0 and earlier. No newer releases have been confirmed to contain the flaw.

The CVSS score is 5.8, indicating a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an untrusted or malicious MCP client or a prompt‑injected agent, which can execute the harmful SELECT statements with minimal prerequisites. The lack of public exploitation data suggests the risk is moderate, but the potential for data loss or corruption warrants timely remediation.