CVE-2026-103248: n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.80 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.39.6 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.40.1
Event History
Frequently Asked Questions
Which workflows are exposed to this issue?
Workflows that use the Supabase node in Filters (String) mode are exposed when untrusted input can influence field values in the filter expression. The issue is caused by those values not being escaped.
What access does an attacker need?
The reported vector is network-accessible and requires no privileges or user interaction. Exploitation still requires the attacker to be able to supply untrusted input that reaches a vulnerable Supabase filter field value.
What could a successful exploit do?
An attacker may inject filter expressions to read all rows in a table, update all records, or delete entire tables in a single request. This can affect confidentiality, integrity, and availability.
Which releases should be remediated?
Affected releases are versions before 1.123.80, versions from 2.0.0 before 2.39.6, and versions from 2.40.0 before 2.40.1. Update to the applicable fixed release line.