Tabularis MCP SQL Injection CVE-2026-118378 Bypasses Read-Only Mode

Read-only mode on an MCP database tool sounds like a safety net. CVE-2026-118378 shows how thin that net can be when the tool builds SQL by gluing strings together.

What the record says

NVD published CVE-2026-118378 on October 28, 2026. It covers Tabularis, an open-source desktop SQL workspace that ships a built-in MCP server for clients such as Claude, Cursor and Devin. The description says versions before 0.28.0 have an SQL injection in the SQLite driver: a crafted table_name passed to the describe_table tool can close a quoted PRAGMA argument and append statements. Attackers, “including AI agents steered by untrusted content,” can then read, modify or drop SQLite data, bypassing read-only mode and write approval. The weakness is CWE-89.

The score on the NVD record, CVSS 4.0 8.5 (high), was set by the VulnCheck CNA and is labelled secondary. NVD’s own status was “Deferred” when we checked, so NIST has not scored it. The vector is local, with passive user interaction. Per the reporter’s advisory, the reason is that the code runs in the MCP server subprocess and is reached over local stdio, not a network socket; the VulnCheck vector agrees, but this rests on that one account. NVD also carries a second VulnCheck score, CVSS 3.1 7.8 with the same vector as the reporter’s estimate. Both NVD scores are CNA-supplied.

How the bug works

The reporter’s GitHub advisory, GHSA-xrx3-j98v-67x9, traces the flaw to several schema-introspection functions in src-tauri/src/drivers/sqlite/mod.rs. They build statements such as PRAGMA table_info('{}') by interpolating the caller’s table_name directly. The advisory says the underlying sqlx SQLite backend runs every statement it finds in the string, not just the first. A value that closes the quote and adds a semicolon therefore runs a second statement for real. The advisory contrasts this with the MySQL and PostgreSQL drivers, which use bound parameters for the same lookup.

The point is the trust boundary. Tabularis advertises read-only mode and a write-approval step for MCP connections, which exist to contain an agent that is not fully trusted. An agent that has read attacker-controlled text can fill tool arguments with attacker-chosen values. Per the advisory, the injected statements ran underneath those controls, and the reporter demonstrated a DROP TABLE. That demonstration was a Python replica of the sqlx statement loop, not the shipped Tabularis binary, by the reporter’s own account.

Timeline and versions

The fix landed fast. The advisory was published on October 13, the fix commit is dated October 13, and release 0.28.0 followed the same day. The 0.28.0 release notes do not name this fix; the evidence is the fix commit and the advisory’s patched-version field. The NVD record only appeared on October 28, so for fifteen days there was no CVE ID to search for (our inference: tools keyed to CVE IDs would have missed it).

The affected range differs by source. NVD says 0.10.0 up to, but not including, 0.28.0. The GitHub advisory says 0.18.0 and earlier, patched in 0.28.0. We did not test versions in between.

Two other MCP advisories sit in the same repository:

• GHSA-vqmg-c6j7-6c3j, published October 12, says read-only mode and write approval can be bypassed by statements that start with a read keyword but write data, such as SELECT ... INTO on PostgreSQL. When we read it, it listed no patched version.
• GHSA-9x4c-wq7x-5fjq, published October 26, says an unvalidated database argument lets MCP input open any SQLite file on the host or reach databases outside the saved connection’s scope. It affects 0.29.0 only and is fixed in 0.30.0. Its CVSS 3.1 vector scores 8.2 (high), per GitHub.

Neither has a CVE ID in the GitHub records we read.

What we do not know

We found no evidence of exploitation as of October 28, 2026 in NVD or the three advisories. The CISA KEV feed we checked was released on October 27 at 19:00 UTC, before this CVE ID was reserved, so its lack of an entry says little. We did not test the exploit, and we did not open VulnCheck’s own advisory page.

What to do

Upgrade Tabularis to 0.30.0 or later. Keep MCP connections to databases with sensitive data separate from agents that browse the web or read inboxes. Our recommendation: back up SQLite files an agent can reach. More broadly, treat every MCP tool argument as untrusted input, and treat a read-only flag as one layer of defense, not the whole defense.

References

• NVD — CVE-2026-118378
• GitHub — fix commit fd1bdbb
• GitHub — GHSA-xrx3-j98v-67x9, SQL injection via table_name
• GitHub — GHSA-9x4c-wq7x-5fjq, unvalidated database parameter
• GitHub — GHSA-vqmg-c6j7-6c3j, read-only mode bypass
• GitHub — Tabularis v0.28.0 release
• GitHub — Tabularis v0.30.0 release