{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0427",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Supabase MCP stored injection can expose private tables through Cursor",
  "details": "## What\n\nThe cited Supabase MCP demonstrations show stored prompt injection in support-ticket content reaching a Cursor-connected database tool. With a service-role key and no read-only boundary, the agent can be induced to return private tables. The source describes a controlled service scenario, not a named victim.\n\n## Which configuration is exposed\n\nThe exposed configuration is Cursor with a Supabase MCP server and a service-role credential rather than a read-only key. Stored support content is attacker-controlled input that can be replayed when the agent handles a later request.\n\n## How ACVE detects it\n\nACVE scopes the Cursor harness and one MCP server whose registry name identifies Supabase. It cannot inspect the key privilege, ticket contents, or database response, so a match requires manual confirmation of the service-role condition.\n\n## Fix\n\nUse a read-only or row-scoped database credential, isolate support-ticket text from tool instructions, and require approval for exports. Rotate the service-role key if it was available to a compromised or overly permissive agent.\n\n## Grounding needed\n\nThe General Analysis and Supabase pages should be checked for the stored-injection reproduction and mitigation language. The record stays demonstrated because no victim statement is cited.\n\nThis record is limited to the condition named in the public source: Supabase MCP stored injection can expose private tables through Cursor. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "cursor"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "prompt-injection-to-tool",
        "data-exfiltration",
        "credential-exposure"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "demonstrated",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://generalanalysis.com/blog/supabase-mcp-blog",
            "type": "research"
          },
          {
            "url": "https://supabase.com/blog/defense-in-depth-mcp",
            "type": "vendor"
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "cveBoundary": "user-configured",
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "cursor"
          },
          {
            "some": "mcpServers",
            "where": {
              "field": "registryName",
              "op": "regex",
              "value": "supabase"
            }
          }
        ]
      },
      "fix": {
        "summary": "Use a read-only Supabase MCP key and review stored support content.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "mcpServers",
            "why": "Use a read-only service boundary."
          },
          {
            "type": "remove",
            "target": "service-role key",
            "why": "Do not give Cursor unrestricted database access."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:26:37Z",
          "sources": [
            {
              "url": "https://generalanalysis.com/blog/supabase-mcp-blog",
              "status": 200,
              "contentType": "text/html; charset=utf-8",
              "sha256": "sha256:e2cdd9048f8f69c4b67241f6cd3e9a7a7ddc2257e5a5fdceed8a22091f4d47de",
              "type": "research"
            },
            {
              "url": "https://supabase.com/blog/defense-in-depth-mcp",
              "status": 200,
              "contentType": "text/html; charset=utf-8",
              "sha256": "sha256:62860d1da148e91ee991adeae629e32861d8786324d6bdb4d6e823017e23084c",
              "type": "vendor"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}