EUVD-2026-63260
GHSA-7vgw-vx83-cq44
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H captures the prerequisite Supabase workflow with attacker-controlled expression input; S:C and C/I/A:H reflect full downstream database impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.
AnalysisAI
PostgREST filter injection in n8n's Supabase integration node exposes any connected Supabase database to full-table disclosure, deletion, or modification across versions before 1.123.69, 2.33.4, and 2.34.1. The Row Get Many, Delete, and Update operations concatenate expression-bindable values into filter queries without sanitization, allowing an attacker who can supply input to a workflow to widen a scoped filter into an unfiltered full-table operation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target n8n instance must have one or more active workflows that include the Supabase integration node performing Row Get Many, Delete, or Update operations; (2) the filter parameter in that node must be populated via an n8n expression that incorporates attacker-controllable input (e.g., a webhook payload field, HTTP query parameter, or form value); and (3) the n8n instance must be connected to a live Supabase backend via a configured credential. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H) scores 7.1. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a public-facing n8n webhook that triggers a workflow containing a Supabase Delete node, where the row filter is populated from the webhook payload using n8n's expression syntax. The attacker crafts a payload that injects a PostgREST filter condition (e.g., a tautology such as 'id=gt.0') alongside the intended filter value, causing the DELETE operation to match and destroy every row in the target table rather than the intended single record. … |
| Remediation | Upgrade n8n to version 1.123.69 or later (1.x deployments), 2.33.4 or later (2.x pre-2.34 deployments), or 2.34.1 or later (2.34.x deployments), per GitHub Security Advisory GHSA-f4f3-2g67-4vhm at https://github.com/n8n-io/n8n/security/advisories/GHSA-f4f3-2g67-4vhm. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all n8n instances with active Supabase integrations and immediately restrict workflow parameter input to trusted sources only; review recent execution logs for anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
The n8n package 0.218.0 for Node.js allows Directory Traversal. Rated medium severity (CVSS 6.5), this vulnerability is
n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allow
This vulnerability in n8n (an open-source workflow automation platform) is an authentication bypass in the OAuth callbac
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary c
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today