CVE-2026-56351
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk12th percentile — higher than 12% of all known CVEs
Summary
An SQL injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes in n8n before version 2.4.0 allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.
Risk Assessment
The risk includes unauthorized access to data, its modification or deletion, and potential takeover of the database by the attacker.
Recommendation
Immediately update n8n to version 2.4.0 or later, which contains a fix for this vulnerability.
Original NVD description (English source)
n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.