What’s Vulnerable › Vulnerabilities

CVE-2026-103255: n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-01
• Weakness: CWE-73

Description

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.

Affected products

• n8n-io n8n: before 1.123.80; from 2.0.0 before 2.39.6; from 2.40.0 before 2.40.1 — fixed in 1.123.80, 2.39.6, 2.40.1

How to fix

Upgrade to a fixed version: n8n-io n8n 1.123.80, 2.39.6, 2.40.1. Check the vendor advisory for mitigations.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-rqch-9jrh-cr8w
• https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-path-traversal-and-query-injection-via-supabase

Get alerted when CVE-2026-103255 or the next vulnerability affects your stack