CVE-2026-77071: Critical Filter Injection in the n8n Supabase Node

CVE-2026-77071 is a critical (CVSS 9.8 in NVD) filter injection in the n8n Supabase node. Row Get Many, Delete and Update built filters by joining an unescaped value, so a crafted value could match every row. Upgrade to n8n 1.123.69, 2.33.4 or 2.34.1, or later.

What's affected

• Product: n8n, the Supabase node (Row Get Many, Delete and Update operations).
• Affected: n8n before 1.123.69, before 2.33.4 and before 2.34.1, on their respective lines.
• Fixed: 1.123.69, 2.33.4 and 2.34.1.
• Weakness: CWE-89, SQL injection.
• Score: NVD lists CVSS 9.8. The n8n advisory rates it 7.1 on CVSS v4. Not listed in CISA KEV.

How to check if you're exposed

Check the n8n version, then find workflows that use the Supabase node.

n8n --version
n8n export:workflow --all --output=workflows.json
grep -c "n8n-nodes-base.supabase" workflows.json

The advisory points at manual filter mode with expression values that come from outside input. For each matching workflow, check whether the filter value is taken from a webhook, form or message. Also check whether the Supabase credential in n8n uses a service role key, since that bypasses row level security.

What to do now

1. Upgrade n8n to 1.123.69, 2.33.4 or 2.34.1, or later.
2. Audit active workflows with Supabase nodes that use manual filter mode, and remove expressions that take values from untrusted input.
3. Add authentication to any webhook trigger that feeds those workflows.
4. If you cannot upgrade yet, add n8n-nodes-base.supabase to NODES_EXCLUDE.
5. Use a Supabase key with the narrowest rights that work, and review recent deletes and updates on tables the workflow touches.

Why it matters

The node concatenated an expression bound value into a PostgREST filter string without escaping it. The attacker's value could add a condition that widened the filter to every row. One intended single row action became a full table read, delete or update.

This sits in the same family as SQL injection. Filter strings built by text joining are fragile, wherever the query language lives. Prefer parameterised calls and narrow database rights.

Quick check

Sources

• n8n GitHub advisory GHSA-f4f3-2g67-4vhm
• VulnCheck advisory

Last reviewed: 19 October 2026.