CVE-2026-77071: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in n8n-io n8n

The vulnerability in n8n before versions 1.123.69, 2.33.4, and 2.34.1 involves a PostgREST filter injection in the Supabase node. The issue stems from concatenating an expression-bindable value into filter queries without proper escaping, enabling attackers to inject SQL conditions that broaden the filter scope. This transforms intended single-row operations into actions affecting entire tables, potentially exposing or altering all rows. The CVSS 4.0 score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, but with high scope and impact on confidentiality, integrity, and availability.

An attacker exploiting this vulnerability can bypass intended row-level filtering in the Supabase node of n8n, resulting in unauthorized full-table data disclosure, deletion, or modification. This compromises the confidentiality, integrity, and availability of the affected database tables within n8n workflows.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the affected Supabase node operations with untrusted input or apply strict input validation and sanitization to mitigate injection risks.