high severity · published 2026-11-12
The read-only setting could still let unrecognized statements run as multiple commands in one request, including transaction changes and writes. If the connecting database role had write privileges, data could be modified through calls meant to be read-only.
CVE: CVE-2026-126196
Source: NVD
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2690 and your operating system.