Executive brief
n8n is a workflow automation platform that connects various business applications and databases. An SQL injection vulnerability in its Oracle Database node allows attackers to inject malicious SQL code when user input is passed through expressions into the Limit field. An attacker could exfiltrate sensitive data from connected Oracle databases, particularly in workflows that accept external input via webhooks without proper validation.
Technical details
This is an SQL injection vulnerability (CWE-89) in n8n's Oracle Database node select operation. The root cause is unsanitized interpolation of user-controlled input from the Limit field directly into SQL queries without parameterization. The attack requires a specific workflow configuration where external input (e.g., from a webhook) is passed via expressions into the Limit field; authentication requirements depend on the workflow's configuration. An authenticated or unauthenticated attacker (depending on workflow setup) can inject arbitrary SQL and exfiltrate data from the connected Oracle database. The issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
Affected products
- n8n n8n < 1.123.32, 2.0.0-2.17.3, 2.18.0
Timeline
- 2026-04-29: disclosed
- 2026-04-29: patched: Versions 1.123.32, 2.17.4, and 2.18.1 released
- 2026-04-22: advisory