CVE-2026-103255

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0

Description A path traversal issue exists in the Supabase node where the tableId parameter is inserted into request paths without proper validation. This allows attackers to exploit workflows that bind tableId to untrusted input to access Auth and Storage APIs using the administrative serviceRole key. This action bypasses Row Level Security (RLS), which is a security feature that restricts which rows of data a user can see or modify, leading to unauthorized data access and modification.

Recommendations Update to version 1.123.80 or later. Update to version 2.39.6 or later. Update to version 2.40.1 or later. Restrict the use of the tableId parameter in the Supabase node to trusted input only.