CVE-2026-103255

CVSS 9.0 (critical) · published 2026-10-01

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.

Weakness: CWE-73

Source: NVD CVE-2026-103255

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-rqch-9jrh-cr8w
• https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-path-traversal-and-query-injection-via-supabase

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.