VV-016highPrompt injection2025-07-08
Supabase MCP: a support ticket gets the agent to dump private tables
General Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role.
What it is
The assistant ran with the service_role key, which bypasses Row Level Security. Text inside a customer ticket told it to read another table and write the results back into the ticket thread.
Supabase later published guidance on defence in depth for its MCP server.
How to check
- Check which key your Supabase MCP connection uses. service_role bypasses all RLS.
- Check whether the agent reads user-submitted rows (tickets, comments, profiles).
How to fix
- Use read-only mode and a project-scoped connection for development, never production data.
- Keep manual approval for every SQL tool call.
Sources
More advisories for this tool
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalCVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx
- criticalLangflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)
- criticalCVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability