Logo

Supabase MCP Vulnerability: How It Can Leak Your SQL Database

A critical look at the Supabase MCP vulnerability that exposes SQL databases, how the leak occurs, and steps to secure your Local AI agents.
CN

Matteo Giardino

•

Jun 14, 2026

•
ai
security
openclaw
Supabase MCP Vulnerability: How It Can Leak Your SQL Database

The recent Supabase MCP vulnerability has exposed a critical attack vector where Local AI agents can inadvertently leak your entire SQL database. If you use the Model Context Protocol (MCP) to connect AI agents like OpenClaw or Claude Code to your Supabase instance, your raw data might be at risk from simple prompt injections.

In this guide, I will explain exactly how this Supabase MCP vulnerability works. I will show how the SQL leak happens. I will explain what you can do today to secure your local environment in 2026.

What is the Supabase MCP Vulnerability?

The Model Context Protocol (MCP) gives AI agents standard access to external tools and databases. However, the Supabase MCP vulnerability arises when the agent gets unrestricted read_query or execute_sql permissions. This happens without proper sanitization.

When a malicious instruction asks the agent to "summarize all user tables," the agent legitimately queries the Supabase endpoint. Because the MCP connection operates with high privileges locally, the agent bypasses standard frontend Row Level Security (RLS) policies. This leads directly to a massive SQL database leak. It is a severe risk.

Securing AI Agents

Read the guide

How the SQL Leak Happens in Local AI

The core issue lies in the trust boundary. Agents using the Supabase MCP connector assume that any query they formulate is safe. Here is the process:

  1. Prompt Injection: An attacker hides a payload in a document. The agent reads it.
  2. MCP Execution: The agent parses the payload. It uses the Supabase MCP tool to execute a query.
  3. Data Exfiltration: The SQL database leak occurs. The agent sends the retrieved rows back to an external server. It uses a simple curl command.

This means that even if your production Supabase is secure, your local development environment connected via MCP becomes the weak link. See the official Supabase security docs for more.

Protecting OpenClaw from the Supabase MCP Vulnerability

After testing this extensively, I found the best defense. The defense against the Supabase MCP vulnerability is restricting the tool's scope.

  • Limit MCP Permissions: Never give your AI agent admin-level database keys. Use a scoped read-only user for the Supabase MCP connection.
  • Network Isolation: Restrict your OpenClaw agent's egress network access. It cannot exfiltrate data even if an SQL leak occurs.
  • Audit Logs: Monitor what SQL queries your agent is executing.
-- Example of a safe read-only role for MCP
CREATE ROLE mcp_readonly_user WITH LOGIN PASSWORD 'secure_password';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO mcp_readonly_user;

By applying these constraints, you can safely use Supabase with MCP. You avoid risking an SQL database leak. This makes your agent architecture robust.

Technical Details of the Supabase MCP Vulnerability

Many developers ask how the Supabase MCP vulnerability bypasses typical protections. The answer is direct database access. When an MCP server connects directly to PostgreSQL using a connection string, it ignores the REST API protections. It ignores Supabase's edge network rules.

The SQL database leak is therefore absolute. It exposes every table. It exposes every column. The AI agent, acting on a malicious prompt, can iterate through the schema.

Mitigating the SQL Database Leak

To stop the SQL database leak, you must enforce limits at the database level. You must use GRANT and REVOKE. You must not rely on the agent's system prompt. System prompts are easily bypassed.

  1. Create a specific role.
  2. Grant it access only to necessary tables.
  3. Test the connection.

These 3 steps ensure safety.

FAQ

Does the Supabase MCP vulnerability affect production databases?

It primarily affects local and development environments. This happens where developers connect their AI agents directly to the database. They use highly privileged API keys. If those keys have production access, production is at risk.

How do I prevent an SQL database leak via MCP?

Always use scoped, read-only credentials. Apply them to the MCP connection. Enforce Row Level Security (RLS) even for the agent's database role. Block external network egress for the agent process.

Is OpenClaw vulnerable by default?

OpenClaw itself is secure. The tools you connect to it define its attack surface. If you install an insecure Supabase MCP connector, the agent executes whatever SQL queries it receives.

The Supabase MCP vulnerability remains a critical issue for developers in 2026. Securing local environments is just as important as securing production environments. When an SQL database leak occurs, the consequences are severe. Always validate your agent's access controls. This ensures your data stays safe.

To summarize, the Supabase MCP vulnerability requires immediate attention. Do not ignore the risk of an SQL database leak. Follow the best practices outlined in this guide. Use read-only roles. Isolate your networks. Stay informed about the latest security threats.

In 2026, the landscape of AI agents is evolving rapidly. The Supabase MCP vulnerability is just one example of the new attack vectors we face. An SQL database leak can destroy a company's reputation. Be proactive. Be secure.

If you want to learn more about securing your agents, check out our guide on NanoClaw. It is a secure alternative. It mitigates many of these risks out of the box.

CN
Matteo Giardino