CVE-2026-103248
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a…
- Risk score
- 63/100
- CVSS
- 9.0 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or dele…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.123.80, 2.39.6 or 2.40.1 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.0 critical
- Remotely exploitable without logging in
References
Original description
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.
Last activity 1 Oct 2026. Patch Forecast updates every hour.