{"id":"CVE-2026-103248","published":"2026-10-01T11:17:18.257","lastModified":"2026-10-01T14:17:20.880","description":"n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-xrqg-3xcp-h45x","tags":[]},{"url":"https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-postgrest-filter-injection-via-supabase","tags":[]}],"exploitRefs":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-xrqg-3xcp-h45x","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows attackers to inject filter expressions, leading to unauthorized data access, modification, or deletion. It matters because it can result in complete data compromise.","exploitability":"Exploitation is relatively straightforward given untrusted input can inject filter expressions, requiring only access to the Supabase node's Filters (String) mode.","blast_radius":"If exploited, attackers can read, update, or delete entire tables, leading to significant data loss or corruption.","remediation":"Upgrade to n8n version 1.123.80 or later, 2.39.6 or later, or 2.40.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","data-breach","web","api"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:47:04.286Z"}}