Executive brief
n8n is an automation platform used to connect different software services and automate business workflows. A security flaw allows users with permission to create or edit workflows to execute unauthorized database commands. This could lead to the theft, modification, or deletion of sensitive data stored in connected Postgres or TimescaleDB databases.
Technical details
A SQL injection vulnerability exists in n8n's TimescaleDB and legacy Postgres v1 nodes due to improper neutralization of special elements in SQL commands (CWE-89). An authenticated attacker with workflow creation or modification privileges can craft malicious parameters to execute arbitrary SQL queries. These queries run with the full permissions of the database account configured within the n8n credential settings. While the primary n8n system impact is rated as low, the impact on the subsequent connected database system is high for confidentiality, integrity, and availability. The issue is resolved in versions 2.25.7 and 2.26.2.
Affected products
- n8n-io n8n < 2.25.7, >= 2.26.0 < 2.26.2
Timeline
- 2026-06-10: advisory: GitHub security advisory published by vendor
- 2026-06-23: disclosed: CVE published to NVD