CVE-2026-103248: n8n Supabase node filter injection in Filters (String) mode

CVE-2026-103248 · Severity: critical · CVSS 9 · Published 2026-10-01

n8n is a workflow automation platform that integrates with various databases and services. The Supabase node's Filters (String) mode fails to properly escape user input, allowing attackers to inject malicious filter expressions. An attacker who controls the filter input could read all table rows, modify all records, or delete entire database tables in a single request without authorization.

Technologies: N8n. Vendors: N8n.

Quick answers

Is CVE-2026-103248 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-103248 being exploited in the wild.
How severe is CVE-2026-103248?
Critical severity, with a CVSS score of 9, published 1 October 2026.
Which products and versions are affected?
N8n before 1.123.80, 2.0.0 before 2.39.6, 2.40.0 before 2.40.1.
Is there a fix for CVE-2026-103248?
Yes: fixed in 1.123.80, 2.39.6, 2.40.1. Until then: Audit all workflows using the Supabase node's Filters (String) mode where the filter value comes from untrusted external data, and replace with the Build Manually filter mode which uses parameterized query construction. Restrict access to workflow triggers that feed untrusted data into Supabase Filters (String) fields. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103248 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-103248?
Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.123.80, 2.39.6, 2.40.1

Audit all workflows using the Supabase node's Filters (String) mode where the filter value comes from untrusted external data, and replace with the Build Manually filter mode which uses parameterized query construction. Restrict access to workflow triggers that feed untrusted data into Supabase Filters (String) fields.

Technical details

The vulnerability is a filter injection (SQL-like injection via PostgREST) in the Supabase node when using Filters (String) mode. The node fails to escape field values before inserting them into database queries, allowing expression injection. An unauthenticated attacker on the network can exploit this via untrusted input to workflows, gaining unauthorized read, write, and delete access to backend database tables.

Affected products

  • n8n n8n before 1.123.80, 2.0.0 before 2.39.6, 2.40.0 before 2.40.1

Timeline

  • 2026-09-16: disclosed
  • 2026-10-01: advisory
  • 2026-09-16: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.