VV-016highPrompt injection2025-07-08
Supabase MCP: a support ticket gets the agent to dump private tables
General Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role.
What it is
The assistant ran with the service_role key, which bypasses Row Level Security. Text inside a customer ticket told it to read another table and write the results back into the ticket thread.
Supabase later published guidance on defence in depth for its MCP server.
How to check
- Check which key your Supabase MCP connection uses. service_role bypasses all RLS.
- Check whether the agent reads user-submitted rows (tickets, comments, profiles).
How to fix
- Use read-only mode and a project-scoped connection for development, never production data.
- Keep manual approval for every SQL tool call.
Sources
More advisories for this tool
- criticalCVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
- criticalCVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connections
- criticalCVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxy
- highCVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server