Executive brief
n8n is a workflow automation tool used to connect different software services and databases. A vulnerability in the MySQL, PostgreSQL, and Microsoft SQL nodes allows authenticated users with workflow creation permissions to execute unauthorized database commands. This could lead to the theft of sensitive data or unauthorized modification of connected databases.
Technical details
A SQL injection vulnerability exists in n8n's database nodes (MySQL, PostgreSQL, and Microsoft SQL) because the application fails to properly escape identifier values, such as table or column names, when dynamically constructing SQL queries. An attacker with 'low' privileges (authenticated with permissions to create or modify workflows) can provide specially crafted identifiers in the node configuration to break out of the intended query structure. This allows for the execution of arbitrary SQL commands against the configured database credentials. The issue is fixed in version 2.4.0 by ensuring special characters in queries are correctly escaped.
Affected products
- n8n-io n8n < 2.4.0
Timeline
- 2026-01-09: patched: Fix commit f73fae6 merged into repository.
- 2026-02-25: disclosed: Advisory published by n8n-io.
- 2026-02-26: advisory: GitHub Advisory GHSA-f3f2-mcxc-pwjx published.