What’s Vulnerable › Vulnerabilities

CVE-2026-77071: n8n before 1.123.69 PostgREST Filter Injection via Supabase

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-20 · updated 2026-09-01
• Weakness: CWE-89

Description

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.

Affected products

• n8n-io n8n: before 1.123.69; from 2.33.0 before 2.33.4; 2.34.0 — fixed in 1.123.69, 2.33.4

How to fix

Upgrade to a fixed version: n8n-io n8n 1.123.69, 2.33.4. Check the vendor advisory for mitigations.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-f4f3-2g67-4vhm
• https://www.vulncheck.com/advisories/n8n-before-postgrest-filter-injection-via-supabase

Get alerted when CVE-2026-77071 or the next vulnerability affects your stack