# CVE-2026-77071: n8n Supabase node PostgREST filter injection in Row operations

Source: https://junglewise.ai/threats/cve-2026-77071-n8n-supabase-node-postgrest-filter-injection-in-row-operations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77071 · Severity: critical · CVSS 9.8 · Published 2026-08-20

n8n is a workflow automation platform that integrates with databases like Supabase. The Supabase node contains a filter injection vulnerability that allows attackers to bypass row-level access controls in Get Many, Delete, and Update operations, potentially exposing, modifying, or deleting entire database tables instead of the intended single rows.

Technologies: [N8n](https://junglewise.ai/threats/technologies/n8n). Vendors: [N8n](https://junglewise.ai/threats/vendors/n8n).

## Quick answers

**Is CVE-2026-77071 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77071 being exploited in the wild.

**How severe is CVE-2026-77071?** Critical severity, with a CVSS score of 9.8, published 20 August 2026.

**Which products and versions are affected?** N8n before 1.123.69, 2.33.4, and 2.34.1.

**Is there a fix for CVE-2026-77071?** A patch was published on 2026-08-20: Patches released in versions 1.123.69, 2.33.4, and 2.34.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77071 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-77071?** Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a filter injection flaw (CWE-89, similar to SQL injection) in the Supabase node's PostgREST filter construction logic. When building filter queries for Row Get Many, Delete, and Update operations, the node concatenates user-supplied expression-bindable values without proper escaping or sanitization. An attacker can inject PostgREST filter syntax to widen the filter condition from a single-row match to match all rows, achieving full-table read, modification, or deletion. The attack requires network access to an n8n instance and the ability to create or modify workflows using the Supabase node; no authentication bypass is needed if workflows accept external input (e.g., via webhooks). Patches are available in n8n versions 1.123.69, 2.33.4, and 2.34.1 or later.

## Affected products

- n8n n8n before 1.123.69, 2.33.4, and 2.34.1

## Timeline

- 2026-08-20: disclosed
- 2026-08-05: advisory: GitHub Security Advisory GHSA-f4f3-2g67-4vhm published
- 2026-08-20: patched: Patches released in versions 1.123.69, 2.33.4, and 2.34.1

## References

- [https://github.com/n8n-io/n8n/security/advisories/GHSA-f4f3-2g67-4vhm](https://github.com/n8n-io/n8n/security/advisories/GHSA-f4f3-2g67-4vhm)
- [https://www.vulncheck.com/advisories/n8n-before-postgrest-filter-injection-via-supabase](https://www.vulncheck.com/advisories/n8n-before-postgrest-filter-injection-via-supabase)

## Related threats

- [n8n path traversal in Databricks node](https://junglewise.ai/threats/cve-2026-119557-n8n-from-2-14-0-through-2-46-3-contains-a-path-traversal)
- [n8n remote code execution in deprecated Function nodes](https://junglewise.ai/threats/cve-2026-119408-n8n-before-2-42-6-2-43-x-before-2-43-3-and-3-x-before-3-0-1)
- [n8n Slack Trigger SSRF and token exfiltration](https://junglewise.ai/threats/cve-2026-118679-n8n-before-1-123-83-2-41-4-and-2-42-1-contains-a-server-side)
- [n8n prototype pollution in workflow history compaction](https://junglewise.ai/threats/cve-2026-118678-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-prototype)
- [n8n Local Gateway deep-link missing confirmation re-pairing](https://junglewise.ai/threats/cve-2026-118677-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-missing)