Executive brief
n8n is a workflow automation platform that allows organizations to build and execute business processes. The PostgreSQL trigger node in n8n improperly handles user-supplied database identifiers, allowing authenticated users to inject malicious SQL code. An attacker with n8n access could read, modify, or delete data from any connected PostgreSQL database, potentially exposing sensitive business information or disrupting operations.
Technical details
The PostgresTrigger node contains a SQL injection vulnerability in how it constructs database queries. User-supplied identifier parameters (channel, function, and trigger names) are interpolated directly into SQL statements without proper escaping or parameterization. An authenticated user with access to n8n can craft malicious input containing SQL metacharacters to break out of the identifier context and execute arbitrary SQL. The attack requires authentication to n8n but no additional user interaction. Successful exploitation grants the attacker full read and write access to the PostgreSQL database with the privileges of the configured database credential. Patches are available in versions 1.123.67, 2.31.5, and 2.32.1.
Affected products
- n8n n8n < 1.123.67, 2.0.0-rc.0 to < 2.31.5, 2.32.0
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched: Patches released in versions 1.123.67, 2.31.5, and 2.32.1