n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.
CVE-2026-103255
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-103255
n8n
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "n8n-io",
"product": "n8n",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.123.80",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.39.6",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.40.0",
"lessThan": "2.40.1",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/n8n",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-103255
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #7698 · Revision 1
- Added to Heist Feed
- Publisher date