{"id":"INC-supabase-01M4838DNQ5VAYPYAJHMCCCHP2","kind":"incident","aliases":[],"related":[],"title":"Supabase: Increased errors on management api leading to project operation failures","description":"This issue has been resolved and our error rates have returned back to normal.\n\nDuring this incident users would have observed unauthorized/5xx failures across multiple operations on the project operations and dashboard functions. We have since rolled out a fix and all functionality is restored.","summary":"Supabase had an incident where its management API returned unauthorized and 5xx errors, causing project operations and dashboard functions to fail. The incident is resolved and Supabase says a fix has been rolled out, but the sources describe availability failures only and do not describe an attacker gaining access.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Supabase","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["database","incident","postgres","security","supabase","vendor"],"not_affected_if":["no-supabase-projects"],"how_to_check":null,"fix":"No action is described in the sources beyond waiting for Supabase's fix, which is already rolled out; confirm project operations and dashboard functions work normally.","status":"resolved","published_at":"2026-10-06T07:53:39+00:00","first_seen_at":"2026-10-23T19:12:22+00:00","triaged_at":"2026-10-23T20:20:14+00:00","updated_at":"2026-10-23T20:20:14+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:20:14Z","model":"claude-haiku-5-5","output":{"fix":"No action is described in the sources beyond waiting for Supabase's fix, which is already rolled out; confirm project operations and dashboard functions work normally.","summary":"Supabase had an incident where its management API returned unauthorized and 5xx errors, causing project operations and dashboard functions to fail. The incident is resolved and Supabase says a fix has been rolled out, but the sources describe availability failures only and do not describe an attacker gaining access.","category":"vendor","who_cares":["supabase","postgres"],"confidence":0.6,"analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["no-supabase-projects"],"severity_if_unknown":"unknown"},"cost_usd":0.000327,"input_tokens":2030,"output_tokens":247,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'01m4838dnq5vaypyajhmccchp2':15A '5xx':34B 'access':71B 'across':95C 'api':6A,30B 'attack':69B 'avail':61B 'back':83C 'caus':36B 'dashboard':40B,103C 'databas':17B 'describ':60B,67B 'error':3A,35B,79C 'fail':43B 'failur':11A,62B,94C 'fix':52B,111C 'function':41B,104C,114C 'gain':70B 'inc':13A 'inc-supabase-01m4838dnq5vaypyajhmccchp2':12A 'incid':18B,26B,45B,88C 'increas':2A 'issu':73C 'lead':7A 'manag':5A,29B 'multipl':96C 'normal':85C 'observ':92C 'oper':10A,38B,97C,101C 'postgr':19B 'project':9A,37B,100C 'rate':80C 'resolv':47B,76C 'restor':116C 'return':31B,82C 'roll':55B,108C 'say':50B 'secur':20B 'sinc':107C 'sourc':59B 'supabas':1A,21B,23B,49B 'supabase':14A,16A 'unauthor':32B 'unauthorized/5xx':93C 'user':89C 'vendor':22B 'would':90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-06T07:53:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"supabase:01M4838DNQ5VAYPYAJHMCCCHP2","url":"https://status.supabase.com/incidents/01M4838DNQ5VAYPYAJHMCCCHP2","severity":"medium","published_at":"2026-10-06T07:53:39+00:00","modified_at":"2026-10-07T15:12:21+00:00","first_seen_at":"2026-10-23T19:12:22+00:00","fetched_at":"2026-10-25T23:27:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}