AI Threat AlertCVE-2026-77071: n8n: Supabase filter injection leaks/wipes full tables
HIGHn8n's Supabase node builds PostgREST filter queries by string-concatenating a user-supplied value without escaping it, so a crafted input can break out of the intended row-scoped filter and widen it to match every row in the table. For a CISO the concern is blast radius, not exploit sophistication: any workflow that pipes external input — a webhook, a form, or an AI agent tool call — into a Supabase Row Get Many, Delete, or Update operation turns a single-record lookup into full-table disclosure, mass deletion, or mass modification. It isn't in CISA KEV and there's no public exploit or Nuclei template yet, but this is a textbook, easily reproduced injection pattern (CWE-89) that tends to get weaponized fast once disclosed, and n8n itself already carries 201 other CVEs and a middling OpenSSF Scorecard (6.6/10) — a package with a track record of security debt sitting at the center of many AI agent stacks. Patch to n8n 1.123.69, 2.33.4, or 2.34.1 immediately; until then, audit every workflow using the Supabase node's Get Many/Delete/Update operations for unsanitized filter inputs and enforce Supabase Row Level Security as a compensating control, since RLS bounds the damage even if the application-layer filter is bypassed.
What is the risk?
Exploitability is moderate: no authentication bypass is required beyond whatever access the workflow already exposes (e.g., a public webhook or an AI agent invoking the node as a tool), but the attacker does need to control a value that flows into the Supabase node's filter parameter — this is a common pattern in n8n workflows that expose lookup/query functionality to end users or to an LLM agent. Impact is high: successful injection yields full-table read, delete, or update against whatever Supabase table the node targets, with no partial-compromise ceiling. Exposure is broad given n8n's popularity as an AI agent orchestration layer and Supabase's popularity as its backing store (16 tracked downstream dependents, package risk score 69/100). No KEV listing, EPSS data, or public PoC exists yet, so near-term mass exploitation is unconfirmed, but the vulnerability class is trivial to weaponize once researchers or attackers reverse-engineer the patch diff.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 step1) Patch n8n to 1.123.69, 2.33.4, or 2.34.1 (or later) — this is the only complete fix, since the flaw is in how n8n constructs the PostgREST query, not in Supabase itself. 2) Until patched, audit all workflows for Supabase node Row Get Many/Delete/Update operations and identify any that accept externally-controlled input (webhook payloads, form submissions, chat/agent tool arguments) into filter fields; disable or gate those workflows. 3) Apply Supabase Row Level Security (RLS) policies on any table reachable via these nodes as defense-in-depth — RLS constrains the effective blast radius even if the application-layer filter is bypassed. 4) Review Supabase query logs for anomalous full-table scans, bulk deletes, or bulk updates correlated with n8n service-role credentials. 5) Rotate the Supabase service role key used by n8n if compromise is suspected, since a leaked or overly-broad key compounds this vulnerability.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-77071?
n8n's Supabase node builds PostgREST filter queries by string-concatenating a user-supplied value without escaping it, so a crafted input can break out of the intended row-scoped filter and widen it to match every row in the table. For a CISO the concern is blast radius, not exploit sophistication: any workflow that pipes external input — a webhook, a form, or an AI agent tool call — into a Supabase Row Get Many, Delete, or Update operation turns a single-record lookup into full-table disclosure, mass deletion, or mass modification. It isn't in CISA KEV and there's no public exploit or Nuclei template yet, but this is a textbook, easily reproduced injection pattern (CWE-89) that tends to get weaponized fast once disclosed, and n8n itself already carries 201 other CVEs and a middling OpenSSF Scorecard (6.6/10) — a package with a track record of security debt sitting at the center of many AI agent stacks. Patch to n8n 1.123.69, 2.33.4, or 2.34.1 immediately; until then, audit every workflow using the Supabase node's Get Many/Delete/Update operations for unsanitized filter inputs and enforce Supabase Row Level Security as a compensating control, since RLS bounds the damage even if the application-layer filter is bypassed.
Is CVE-2026-77071 actively exploited?
No confirmed active exploitation of CVE-2026-77071 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-77071?
1) Patch n8n to 1.123.69, 2.33.4, or 2.34.1 (or later) — this is the only complete fix, since the flaw is in how n8n constructs the PostgREST query, not in Supabase itself. 2) Until patched, audit all workflows for Supabase node Row Get Many/Delete/Update operations and identify any that accept externally-controlled input (webhook payloads, form submissions, chat/agent tool arguments) into filter fields; disable or gate those workflows. 3) Apply Supabase Row Level Security (RLS) policies on any table reachable via these nodes as defense-in-depth — RLS constrains the effective blast radius even if the application-layer filter is bypassed. 4) Review Supabase query logs for anomalous full-table scans, bulk deletes, or bulk updates correlated with n8n service-role credentials. 5) Rotate the Supabase service role key used by n8n if compromise is suspected, since a leaked or overly-broad key compounds this vulnerability.
What systems are affected by CVE-2026-77071?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, vector databases, workflow orchestration pipelines.
What is the CVSS score for CVE-2026-77071?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationAML.T0086Exfiltration via AI Agent Tool InvocationAML.T0101Data Destruction via AI Agent Tool InvocationCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.
Exploitation Scenario
An organization runs an n8n workflow triggered by a public webhook that lets customers retrieve their own order history from a Supabase table via a Row Get Many operation, filtering on a customer_id value taken from the request. An attacker submits a crafted customer_id designed to break out of the intended PostgREST filter expression — for example injecting an operator that always evaluates true — causing the query to return every row in the table instead of just the attacker's own records, exposing other customers' PII in one response. Applying the same technique against the Delete or Update operation on the same node lets the attacker mass-delete the table or silently rewrite records instead of merely reading them, with no additional authentication required beyond the normal ability to trigger the webhook.
Weaknesses (CWE)
CWE-89Improper Neutralization of Special Elements used in an SQL CommandPrimaryCWE-89Improper Neutralization of Special Elements used in an SQL CommandCWE-89 — Improper Neutralization of Special Elements used in an SQL Command: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used properly.
- [Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Process SQL queries using prepared statements, parameterized queries, or stored procedures. These features should accept parameters or variables and support strong typing. Do not dynamically construct and execute query strings within these features using "exec" or similar functionality, since this may re-introduce the possibility of SQL injection. [REF-867]
Source: MITRE CWE corpus.
References
- github.com/n8n-io/n8n/security/advisories/GHSA-f4f3-2g67-4vhmvendor-advisory
- vulncheck.com/advisories/n8n-before-postgrest-filter-injection-via-supabasethird-party-advisory
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n