CVE-2026-77071: n8n before 1.123.69 PostgREST Filter Injection via Supabase
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.69 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.33.4 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.34.1
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Prioritize n8n deployments that use the Supabase node's Row Get Many, Delete, or Update operations. The issue affects releases before 1.123.69, 2.33.4, and 2.34.1.
What level of attacker control is needed?
An attacker needs control over a value that can be bound into the affected filter expression. That value can be used to inject an additional condition that broadens the filter.
What is the potential operational impact?
A manipulated filter can match every row rather than the intended row or subset. Depending on the operation, this can cause full-table data disclosure, deletion, or modification.