CVE-2026-77071 is a filter-injection vulnerability in n8n's Supabase node. When constructing PostgREST filter expressions, the node concatenates user-supplied values directly into the filter string rather than escaping PostgREST's expression DSL metacharacters. This allows an attacker to break out of the intended filter and widen the query scope — converting a single-row retrieval into a table-wide exfiltration.
The vulnerability's true severity lies in what happens after the data leaves the database. n8n workflows are data pipelines: the output of a compromised Row Get Many node flows directly into subsequent nodes. An attacker who widens a filter to extract administrative credentials can pipe those credentials into downstream nodes that perform privileged operations — API calls, webhooks, data writes. From n8n's perspective, every step succeeds. The workflow logs show normal execution. There's no anomaly to alert on.
Worse, this attack surface extends through n8n's workflow-sharing ecosystem. Workflows are importable JSON artifacts that execute with the importing user's credentials. A malicious workflow containing a weaponized Supabase node published to the community marketplace could compromise anyone who imports it — without the attacker needing any access to the target n8n instance.
Verify your version: 1.123.69, 2.33.4, or 2.34.1 contain the fix. However, patching the node doesn't defuse workflows that already executed during the vulnerable window — those may have already extracted and propagated credentials. Review workflows that used the Supabase node prior to patching, and audit any that reference administrative credentials or elevated permissions. For self-hosted deployments, the CVE-to-patch gap is your actual vulnerability window: organizations on older versions remain exposed indefinitely.