CVE-2026-103255 Overview
CVE-2026-103255 is a path traversal vulnerability [CWE-73] in the n8n workflow automation platform. The flaw affects the Supabase node, where the tableId parameter is inserted into request paths without validation. Attackers who control workflow inputs bound to tableId can traverse out of the intended REST endpoint and reach Supabase Auth and Storage APIs. Because the Supabase node authenticates with the administrative serviceRole key, exploitation bypasses Row Level Security (RLS). The vulnerability affects n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1.
Critical Impact
Unauthenticated or low-privileged attackers can read, modify, or delete Supabase data and user accounts through workflows that bind untrusted input to tableId, bypassing RLS protections.
Affected Products
- n8n versions before 1.123.80
- n8n versions from 2.0.0 before 2.39.6
- n8n versions from 2.40.0 before 2.40.1
Discovery Timeline
- 2026-10-01 - CVE-2026-103255 published to NVD
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-103255
Vulnerability Analysis
The Supabase node in n8n constructs REST API request paths by concatenating the tableId parameter directly into the URL. The node does not validate or sanitize tableId to confirm it refers to a legitimate table name. When a workflow binds tableId to data derived from an incoming webhook, form submission, or other untrusted source, an attacker can supply traversal sequences such as ../auth/v1/admin/users or ../storage/v1/object/....
The resulting request is sent with the Supabase serviceRole key, which grants administrative access across the project. This context switch moves the attacker from a table-scoped REST call to privileged Auth and Storage endpoints. Row Level Security, which depends on scoped tokens, provides no barrier because the serviceRole key is explicitly designed to bypass RLS policies.
Root Cause
The root cause is improper neutralization of path traversal sequences in a user-controlled path segment [CWE-73]. The Supabase node trusts the tableId value and performs string concatenation rather than validating that the value matches an allowed table identifier pattern.
Attack Vector
Exploitation requires an n8n workflow that passes attacker-controllable data into the tableId field of a Supabase node. Common exposure patterns include public webhooks, chat triggers, or form nodes feeding Supabase operations. The attacker submits a payload containing ../ sequences that redirect the request to Supabase Auth (/auth/v1/admin/*) or Storage (/storage/v1/*) endpoints. The traversed request executes with administrative privileges, enabling user enumeration, account creation, password resets, object reads, and object writes. See the GitHub Security Advisory GHSA-rqch-9jrh-cr8w and the VulnCheck Advisory on n8n for additional technical context.
Detection Methods for CVE-2026-103255
Indicators of Compromise
- Supabase access logs containing requests to /auth/v1/admin/* or /storage/v1/object/* originating from the n8n egress IP during workflow execution windows.
- Request paths containing encoded or raw ../ sequences in the tableId segment of REST calls (/rest/v1/..%2F or /rest/v1/../).
- Unexpected Supabase Auth events such as new admin users, password resets, or token issuance tied to the serviceRole key.
- n8n workflow executions where webhook or form input values contain path traversal payloads passed to Supabase nodes.
Detection Strategies
- Inspect n8n execution history for Supabase node invocations whose tableId value contains /, .., or URL-encoded traversal characters.
- Alert on Supabase REST gateway logs where the path after /rest/v1/ resolves outside the rest namespace.
- Correlate serviceRole key usage with endpoints other than /rest/v1/, which indicates traversal into Auth or Storage.
Monitoring Recommendations
- Enable Supabase audit logging and forward logs to a SIEM for retention and correlation with n8n workflow telemetry.
- Monitor the n8n host for outbound requests to Supabase Auth and Storage endpoints that are not expected by legitimate workflows.
- Track changes to Supabase user tables, roles, and storage buckets after any suspicious workflow execution.
How to Mitigate CVE-2026-103255
Immediate Actions Required
- Upgrade n8n to version 1.123.80, 2.39.6, or 2.40.1 or later depending on the deployed release branch.
- Audit all workflows that use the Supabase node and identify any that bind tableId to untrusted input such as webhook payloads or form fields.
- Rotate the Supabase serviceRole key if any workflow processed untrusted tableId input prior to patching.
- Review Supabase Auth and Storage audit logs for the retention window to confirm no unauthorized administrative actions occurred.
Patch Information
n8n maintainers released fixed versions 1.123.80, 2.39.6, and 2.40.1. Users on the 1.x branch should upgrade to 1.123.80, users on the 2.0.0–2.39.x branch should upgrade to 2.39.6, and users on the 2.40.x branch should upgrade to 2.40.1. Patch details are published in the GitHub Security Advisory GHSA-rqch-9jrh-cr8w.
Workarounds
- Hard-code tableId values in Supabase nodes rather than binding them to expressions sourced from workflow inputs.
- Insert a validation node before each Supabase operation that rejects tableId values containing /, ., or non-alphanumeric characters.
- Replace the administrative serviceRole key with a scoped Supabase key where feasible to limit the blast radius of any residual path traversal.
- Restrict n8n webhook exposure using network controls or authentication until workflows can be reviewed and the platform patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
