CVE-2026-103256 – n8n

This n8n update fixes eight flaws in the workflow automation platform: two Critical and six High. CVE-2026-103248 has a CVSS score of 9.0, Critical severity. It is a filter injection flaw in the Supabase node that lets attackers read, update, or delete entire tables in a single request. CVE-2026-103255 has a CVSS score of 9.0, Critical severity. It is a path traversal flaw in the Supabase node that uses the administrative serviceRole key to bypass Row Level Security. CVE-2026-86076 has a CVSS score of 8.7, High severity, and CVE-2026-83083's companion flaw CVE-2026-86083 has a CVSS score of 7.7, High severity. Both are code injection flaws in the expression engine that enable remote code execution on the backend.

The remaining High severity flaws expose credentials and access controls. CVE-2026-103257 has a CVSS score of 7.7, High severity, and lets crafted resource IDs reach workflows, executions, and credential secrets. CVE-2026-103259 has a CVSS score of 7.6, High severity, and leaks collaborators' session tokens through Dynamic Credentials endpoints. CVE-2026-103251 has a CVSS score of 7.1, High severity, and lets attackers with Redis write access install arbitrary npm packages across queue-mode clusters. CVE-2026-103256 has a CVSS score of 7.1, High severity, and sends Wekan and Baserow passwords to attacker-chosen hosts. Fixed releases are 1.123.80, 2.39.6, and 2.40.1.