CVE-2026-77071CWE-89sql-injection

CVE-2026-77071

Critical · published August 20, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00615 · 48.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-08-20T16:16Z
Affected products (3)
ProductVersionsFixed in
n8n/n8n< 1.123.691.123.69
n8n/n8n≥ 2.33.0, < 2.33.42.33.4
n8n/n8nall versions—
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-f4f3-2g67-4vhm · [email protected]https://www.vulncheck.com/advisories/n8n-before-postgrest-filter-injection-via-supabase · [email protected]
EPSS history
Timeline
  • 20 AUG 11:21Z
    n8n before 1.123.69 PostgREST Filter Injection via Supabase
    cvelistv5