Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
n8n の Supabase ノードにPostgRESTフィルタインジェクション。Get Many/Delete/Update が値をエスケープせず連結していたため、1行のはずの操作が全行に及びます。修正版は系列ごとに 1.123.69 / 2.33.4 / 2.34.1 です。 https://cve.autoarticles.net/cve/CVE-2026-77071
Post summary
The post details a PostgREST filter injection in n8n’s Supabase node that could make CRUD operations affect all rows, and it lists patch versions that fix the vulnerability.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | n8n | n8n | - | node.js | - |
| App | n8n | n8n | 2.34.0 | node.js | - |