Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck

CVE-2026-103255n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

Critical 9.0

In plain English

A critical-severity security flaw in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)0.3%top 77.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	0 – before 1.123.802.0.0 – before 2.39.62.40.0 – before 2.40.1

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-rqch-9jrh-cr8w) vendor-advisory
VulnCheck Advisory: n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase third-party-advisory