Executive brief
n8n is a popular workflow automation tool used to connect different software services. A security flaw in its legacy MySQL connector allows attackers to inject malicious database commands if a workflow is exposed to the internet (for example, via a webhook). This could lead to unauthorized access, modification, or deletion of sensitive data stored in the connected MySQL database.
Technical details
A SQL injection vulnerability exists in the n8n legacy MySQL v1 node's 'executeQuery' operation. The root cause is the direct substitution of evaluated '{{ ... }}' expression values into raw SQL strings without proper parameterization. If a workflow utilizes this node with expression-sourced values and is triggered by an externally-reachable source like a Webhook node, an attacker can provide malicious input to execute arbitrary SQL commands. This allows for full CRUD operations on the downstream database using the configured MySQL credentials. The issue is resolved in versions 1.123.61, 2.27.4, and 2.28.1; the MySQL v2 node is unaffected as it uses parameterized queries.
Affected products
- n8n-io n8n < 1.123.61, >= 2.0.0-rc.0 < 2.27.4, >= 2.28.0 < 2.28.1
Timeline
- 2026-06-24: disclosed: Initial publication by n8n-io
- 2026-07-22: advisory: GitHub Advisory published/updated
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-hwmj-qg4v-cvg9
- https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.61
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.27.4
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.28.1
- https://www.vulncheck.com/advisories/n8n-sql-injection-in-mysql-v1-executequery-operation-via-expression-interpolation