{"id":"CVE-2026-103255","published":"2026-10-01T11:17:19.717","lastModified":"2026-10-01T20:17:22.840","description":"n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-rqch-9jrh-cr8w","tags":[]},{"url":"https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-path-traversal-and-query-injection-via-supabase","tags":[]}],"exploitRefs":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-rqch-9jrh-cr8w","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows path traversal, enabling attackers to access unauthorized data and modify it by leveraging untrusted input in the tableId parameter.","exploitability":"Exploitation is relatively easy given that attackers can use untrusted input to traverse to sensitive APIs, requiring only that the serviceRole key is accessible.","blast_radius":"If exploited, this vulnerability could lead to unauthorized data access and modification across the entire system, impacting multiple users and services.","remediation":"Upgrade to n8n version 1.123.80 or later, 2.39.6 or later, or 2.40.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["path-traversal","data-access","auth-bypass"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:47:06.189Z"}}