NVD CRITICAL: CVE-2026-103248 — n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2...

Thursday, October 1, 2026 at 11:17 AM UTC·Source: NIST NVD

Updated: Thursday, October 1, 2026 at 12:00 PM UTC

Executive Summary

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-103248

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 1, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

US sanctions Tren de Aragua gang members in ATM hacks crackdown

The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States. [...]

51m agoBleepingComputer

MEDIUMVulnerabilityNEW

YouTuber raises $15m for Brazil's 'Cash App'

NG.Cash, the "Brazilian Cash App" founded by a former YouTuber, has raised $15 million to back its efforts to bring credit and crypto services to the country's young, unbanked population.

57m agoFinextra

MEDIUMVulnerability

Unidentified Flock Cameras in Florida

St. Lucie County in Florida discovered ( alt link ) a dozen Flock cameras whose ownership it can’t identify, and that the county government had not permitted. I am reminded of the decade-old story of StingRay cell phone surveillance devices in Washington, DC, whose operators were also unknown. My guess is that in the StingRay case, the devices were operated by foreign actors. This Flock case

1h agoSchneier on Security