CVE-2024-24213

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the...

9.8 CriticalDisputed

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pg_meta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.07%Up 1.0 points since Feb 9, 2024

What each source reports

NVD Score used 9.8

Record: CVE-2024-24213
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2024-24213
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

EUVDEUVD-2024-21637 9.8

Record: EUVD-2024-21637
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vq84-wx4w-6r76 9.8

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the...

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query.

Record: GHSA-vq84-wx4w-6r76
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSVBIT-postgresql-2024-24213 No score

Record: BIT-postgresql-2024-24213
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`postgresql` Bitnami	15.1.0 to 15.1.0	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-24213 is a critical vulnerability (CVSS 9.8) in Postgresql, published February 8, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 65th percentile.