CVE-2026-54238 supabase CVE debrief

Who should care

Defenders responsible for Supabase Realtime instances should assess exposure and apply patches to prevent unauthorized broadcasts. This includes verifying exposure, applying patches, and monitoring for suspicious activity. Security teams and vulnerability management teams should also review the impact of this vulnerability on their systems and prioritize patching.

Why it matters

CVE-2026-54238 allows unauthenticated broadcast of realtime messages to subscribers in Supabase Realtime instances prior to version 2.103.1. Defenders should verify exposure, apply patches, and monitor for suspicious activity.

• Verification of exposure to unauthenticated broadcast
• Potential for unauthorized data dissemination
• Need for patch application to prevent exploitation
• Monitoring for suspicious broadcast activity

Technical summary

The Supabase Realtime REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. This allows an unauthenticated attacker to broadcast realtime messages to subscribers. The attack can be performed via the Internet/only from within the supabase project. The impact of broadcasting messages to subscribers is application specific. This issue has been patched in version 2.103.1. Defenders should prioritize verification of exposure and apply patches for Supabase Realtime versions prior to 2.103.1.

Defensive priority

Defenders should prioritize verification of exposure and apply patches for Supabase Realtime versions prior to 2.103.1.

Recommended defensive actions

• Verify exposure of Supabase Realtime instances to unauthenticated broadcast
• Apply patches for Supabase Realtime versions prior to 2.103.1
• Monitor for unauthorized broadcasts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the patched version. The vulnerability was patched in version 2.103.1. The attack can be performed via the Internet/only from within the supabase project. The impact of broadcasting messages to subscribers is application specific. Evidence is limited to public sources and CVE record details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.