Executive brief
n8n is a workflow automation platform that integrates with databases like Supabase. The Supabase node contains a filter injection vulnerability that allows attackers to bypass row-level access controls in Get Many, Delete, and Update operations, potentially exposing, modifying, or deleting entire database tables instead of the intended single rows.
Technical details
The vulnerability is a filter injection flaw (CWE-89, similar to SQL injection) in the Supabase node's PostgREST filter construction logic. When building filter queries for Row Get Many, Delete, and Update operations, the node concatenates user-supplied expression-bindable values without proper escaping or sanitization. An attacker can inject PostgREST filter syntax to widen the filter condition from a single-row match to match all rows, achieving full-table read, modification, or deletion. The attack requires network access to an n8n instance and the ability to create or modify workflows using the Supabase node; no authentication bypass is needed if workflows accept external input (e.g., via webhooks). Patches are available in n8n versions 1.123.69, 2.33.4, and 2.34.1 or later.
Affected products
- n8n n8n before 1.123.69, 2.33.4, and 2.34.1
Timeline
- 2026-08-20: disclosed
- 2026-08-05: advisory: GitHub Security Advisory GHSA-f4f3-2g67-4vhm published
- 2026-08-20: patched: Patches released in versions 1.123.69, 2.33.4, and 2.34.1