by Kastro
Paper/Archive/CVE-2026-103255

CVE-2026-103255

n8n-io n8n — n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

EPSS 0.3%CVSS 9.0
critical.is priorityof 100
31
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 22.2.222 × 204.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.

Affected

ProductAffectedFixed inSource
n8n< 1.123.801.123.80CNA
n8n2.0.0 – < 2.39.62.39.6CNA
n8n2.40.0 – < 2.40.12.40.1CNA

Scores by source

VulnCheck (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
VulnCheck (CNA)7.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/n8n-io/n8n/security/advisories/GHSA-rqch-9jrh-cr8wwriteupvulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-path-traversal-and-query-injection-via-supabase