sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-77071 n8n before 1.123.69 PostgREST Filter Injection via Supabase

High 7.1 Published Updated

Attackers can inject PostgREST filters in n8n Supabase nodes to read, modify, or delete all database rows instead of single records.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2026-77071?

CVE-2026-77071 is a high-severity SQL injection vulnerability in N8n N8n, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.

Weakness: CWE-89

Which versions are affected by CVE-2026-77071?

It affects 1 product.

Products include N8n N8n.

How do I fix CVE-2026-77071?

Upgrade to a fixed version.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-77071 being exploited?

There is no known exploitation of CVE-2026-77071 in the wild and no public exploit code.

All N8n N8n vulnerabilities

Sources

Also known as GHSA-7vgw-vx83-cq44, GHSA-f4f3-2g67-4vhm, MINI-457h-7gw2-xrq8.

Is CVE-2026-77071 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free