CVE-2026-103248

{
  "etk_id": "ETK-2026-243",
  "cve_id": "CVE-2026-103248",
  "display_id": "CVE-2026-103248",
  "ghsa_id": "GHSA-c6j4-7wv3-xqf9",
  "euvd_id": "EUVD-2026-90642",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Filter injection in n8n Supabase node",
  "summary": "n8n releases before 1.123.80, 2.0.0 through before 2.39.6, and 2.40.0 through before 2.40.1 are affected in the Supabase node's Filters (String) mode. An attacker who can supply untrusted filter field values may cause unauthorized reads, modifications, or deletion of data in the connected Supabase table.",
  "mitigation": "Upgrade n8n to 1.123.80, 2.39.6, or 2.40.1 or later in the applicable release line. Until upgraded, do not pass untrusted input into the Supabase node's Filters (String) mode.",
  "vendor": "n8n-io",
  "product": "n8n",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.123.80",
        ">= 2.0.0, < 2.39.6",
        ">= 2.40.0, < 2.40.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.123.80",
        "2.39.6",
        "2.40.1"
      ],
      "package_name": "n8n",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.003,
  "epss_percentile": 0.2149,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 40.31440358333333,
  "t0_at": "2026-10-01T10:41:55.024000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T10:41:55.024000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T10:41:55.024000+00:00",
      "url": "https://github.com/advisories/GHSA-c6j4-7wv3-xqf9"
    }
  }
}