CVE-2026-103255 in n8n
Summary
by MITRE • 10/01/2026
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in n8n versions prior to 1.123.80, as well as specific ranges within version 2.x (specifically from 2.0.0 up to but not including 2.39.6, and from 2.40.0 up to but not including 2.40.1), represents a critical path traversal flaw located within the Supabase integration node. This security defect arises because the tableId parameter is directly concatenated into API request paths without sufficient validation or sanitization of user-supplied input. In automation workflows, it is common for users to bind dynamic values from external triggers or previous workflow steps to parameters such as tableId. When this binding involves untrusted data sources, an attacker can manipulate the value passed to the Supabase node to construct malicious file paths that deviate from the intended database operations.
The technical mechanism of exploitation relies on the ability to traverse directory structures using standard path traversal sequences, typically represented by dot-dot-slash characters or their URL-encoded equivalents. By injecting these sequences into the tableId field, an attacker can redirect API requests away from the designated data tables and toward sensitive administrative endpoints within the Supabase ecosystem. Specifically, this manipulation allows access to the Authentication (Auth) and Storage APIs, which are normally restricted by Row Level Security policies when accessed through standard database interactions. The core of the vulnerability lies in the fact that these traversal attacks bypass the intended scope limitations imposed on the API key being used, provided that the workflow is configured with an administrative serviceRole key.
The operational impact of this vulnerability is severe due to its potential for unauthorized data access and modification. Because the attack leverages the administrative serviceRole key, it effectively neutralizes Row Level Security controls that would otherwise restrict what data a user or application can read or write. This means that once an attacker successfully exploits the path traversal flaw, they gain elevated privileges equivalent to those of the administrator account associated with the API key. Consequently, attackers can exfiltrate sensitive customer data, alter critical records, upload malicious files to storage buckets, and potentially compromise authentication mechanisms by manipulating user accounts or session tokens. This level of access undermines the integrity, confidentiality, and availability of the entire Supabase project integrated into the n8n workflow.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it involves accessing resources outside the intended directory or scope through path manipulation. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this behavior is consistent with techniques related to Data from Information Repositories and potentially Account Manipulation if used to alter authentication settings. The exploitation vector typically falls under Remote Code Execution via a Web Application interface, specifically leveraging insecure deserialization or parameter injection patterns where untrusted input directly influences system resource access paths.
To mitigate this vulnerability, organizations must immediately upgrade n8n to version 1.123.80 or later for the legacy branch, and to version 2.39.6 or higher (excluding the vulnerable 2.40.x series until at least 2.40.1) for newer installations. It is imperative that administrators review existing workflows that utilize the Supabase node with administrative serviceRole keys. Best practices dictate replacing these high-privilege keys with scoped API tokens that have minimal permissions necessary for specific tasks, thereby limiting the blast radius even if a traversal attempt occurs. Additionally, implementing strict input validation on all parameters passed to integration nodes is essential; developers should ensure that table identifiers are validated against an allowlist of known valid tables rather than accepting arbitrary strings. Regular security audits and penetration testing of automation workflows can further help identify similar injection points before they are exploited in production environments.