Researcher demo (General Analysis): a support ticket led an MCP assistant to expose private tables
Demonstration with dummy data; not a reported breach of Supabase.
- Product
- Supabase MCP (with service_role)
- Affected
- MCP assistants using a role that bypasses RLS
- Fixed in
- No CVE; mitigation is configuration
Last verified against sources: October 16, 2026
What happened
- According to General Analysis' research (July 2025), in a demonstration, instructions planted in a customer support ticket redirected a developer's MCP assistant (used from Cursor) into reading private tables and copying them into a customer-visible reply. [1]
Impact
- The demo used service_role privileges, which bypass RLS; the assistant read sensitive dummy data. The researchers note it does not show every MCP connection uses this role. [1]
What was done
- The write-up says project scoping, read-only SQL and tool-call review limit this path, while read-only access still allows reading whatever the role can see. [1]
How to protect yourself
- Scope the MCP connection to one project, use read-only mode, and review tool calls before they run. [1]
Sources
- Supabase MCP can leak your entire SQL database — General Analysis
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Corrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.