CVE-2026-118378

Tabularis MCP schema inspection can bypass SQLite read-only controls

TabularisDB · Tabularis SQLite driver and MCP server

First documented disclosure · Review checkpoint

Summary

An MCP describe_table argument can inject additional SQL statements.

Severity and exploitation evidence

High · 8.5/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Schema-introspection PRAGMA queries interpolate table names; the SQLite backend executes stacked statements.

Conditions required

Local stdio MCP tool access, such as an agent session induced to use an attacker-controlled table name.

Potential impact

Read, change or delete SQLite data despite the advertised MCP read-only mode and write approval.

Affected versions and configurations

Tabularis >=0.10.0, <0.28.0.

Fix and mitigation status

0.28.0.

Practical next steps

Upgrade, restrict MCP database permissions and verify read-only controls at the database boundary.

Operating lesson

A tool described as read-only still needs safe queries and enforced database permissions.

Evidence and limits

The maintainer advisory and release date to October 13; CVE publication was October 28. The reporter traced the pinned SQLite driver source and reproduced the stacked-statement mechanism with libsqlite3, but did not compile or run the shipped Tauri/Rust binary. Preserve the local attack vector; this is not an unauthenticated internet endpoint.

Sources