ACVE-2026-0427

In the wild

demonstrated · research, vendor

Description

What

The cited Supabase MCP demonstrations show stored prompt injection in support-ticket content reaching a Cursor-connected database tool. With a service-role key and no read-only boundary, the agent can be induced to return private tables. The source describes a controlled service scenario, not a named victim.

Which configuration is exposed

The exposed configuration is Cursor with a Supabase MCP server and a service-role credential rather than a read-only key. Stored support content is attacker-controlled input that can be replayed when the agent handles a later request.

How ACVE detects it

ACVE scopes the Cursor harness and one MCP server whose registry name identifies Supabase. It cannot inspect the key privilege, ticket contents, or database response, so a match requires manual confirmation of the service-role condition.

Fix

Use a read-only or row-scoped database credential, isolate support-ticket text from tool instructions, and require approval for exports. Rotate the service-role key if it was available to a compromised or overly permissive agent.

Grounding needed

The General Analysis and Supabase pages should be checked for the stored-injection reproduction and mitigation language. The record stays demonstrated because no victim statement is cited.

This record is limited to the condition named in the public source: Supabase MCP stored injection can expose private tables through Cursor. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

and
  harness.id eq "cursor"
  some mcpServers where
    registryName regex "supabase"

Fix

Use a read-only Supabase MCP key and review stored support content.

• Reconfigure mcpServers. Use a read-only service boundary.
• Remove service-role key. Do not give Cursor unrestricted database access.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.