n8n: N8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in…
n8n
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-77071
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 20, 2026
- Source last modified
- September 1, 2026
Description
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating work by connecting apps and online services into step-by-step workflows. This flaw affects versions before 1.123.69, 2.33.4, and 2.34.1. The problem is in the Supabase building block (which connects workflows to a Supabase database), specifically its actions for getting many rows, deleting rows and updating rows. An attacker could slip in an extra condition so that an action meant to touch a single row instead matches every row in a table, letting them see, delete or change all of it. This flaw is rated Critical.
What to do
- The person who installed or runs n8n for your organization should find out which version is currently in use.
- Update n8n to
1.123.69,2.33.4or2.34.1, picking the fixed release that matches the version line you already run, or a later release in that line. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- Check the vendor advisory linked on this page if you are unsure which fixed release fits your installation.
Analysis written from the source record as of September 1, 2026 and reviewed before publishing.