Summary
A path traversal vulnerability in the n8n Supabase node allows an attacker to influence API request paths through an untrusted tableId workflow parameter. In affected configurations, this may redirect requests from database tables to Supabase Auth or Storage APIs, where the administrative service-role key could enable unauthorized data access or modification.
Affected context
The issue occurs in n8n workflows that use the Supabase node and bind the tableId parameter to attacker-controlled or otherwise untrusted input. Risk is higher when the node constructs request paths without validating that the supplied identifier refers only to an approved table, allowing requests to reach APIs outside the intended database-table scope.
Exploit preconditions
- Attack surface: The Supabase node's API request path construction
- Required access: Ability to influence workflow input, trigger a workflow, or modify a workflow so that
tableIdreceives untrusted data - Trigger point: Execution of a Supabase node operation that incorporates
tableIdinto an HTTP request path - Why exploitation is possible: The parameter is inserted into request paths without sufficient validation or restriction to an expected table identifier
- Security dependency: The n8n instance must have access to Supabase using a service-role credential with permissions beyond the intended table operation
Why this happens
The underlying bug is external control of a resource identifier used in a request path without adequate canonicalization, allowlisting, or boundary enforcement. A path component intended to identify a database table can influence which Supabase API resource receives the request, potentially crossing from the database API into Auth or Storage APIs. This behavior maps to CWE-73: External Control of File Name or Path, applied here to externally controlled API path construction rather than direct filesystem access.
Potential impact
- Unauthorized reading of Supabase database, authentication, or storage data may occur
- Protected records or stored objects could be modified or deleted
- Row Level Security controls could be bypassed when requests use an administrative service-role key
- User, identity, or access-control data could be exposed or altered
- Workflows and connected applications could experience data integrity or availability impacts
General mitigation guidance
Mitigation generally focuses on preventing untrusted values from controlling API resource paths and reducing the privileges available to workflow nodes.
Common defensive patterns include:
- Restricting table and resource identifiers to a strict allowlist derived from trusted configuration
- Validating identifiers against an expected schema before constructing requests
- Separating database, Auth, and Storage operations behind distinct, purpose-specific interfaces
- Avoiding administrative service-role credentials when a narrower credential or delegated access model is sufficient
- Applying least privilege to service accounts and limiting which workflows can use sensitive credentials
- Treating workflow inputs, webhooks, and user-supplied fields as untrusted by default
- Enforcing authorization and resource-boundary checks independently of client-controlled parameters
How teams detect issues like this
Detection approaches can include:
- Static analysis rules that flag external values concatenated into URL or API path strings
- Code review checks for missing allowlists, canonicalization, or schema validation around resource identifiers
- Workflow analysis that identifies Supabase nodes receiving
tableIdfrom webhooks, forms, expressions, or other untrusted sources - Runtime monitoring for requests from database operations to unexpected Auth or Storage endpoints
- Policy enforcement preventing high-privilege credentials from being attached to workflows with externally controlled parameters
- Automated security review tools that identify path construction and excessive credential-privilege patterns
