Executive brief
n8n is an open-source workflow automation platform that allows users to connect various applications and services. The legacy MySQL v1 node in n8n contains a SQL injection flaw that allows attackers to inject arbitrary SQL commands when workflows receive externally-triggered input. This could enable unauthorized access, modification, or deletion of data in connected databases, depending on the database user's privileges. The newer MySQL v2 node is not affected, and patched versions have addressed this issue.
Technical details
A SQL injection vulnerability exists in n8n's legacy MySQL v1 node executeQuery operation due to unsafe expression interpolation. The vulnerable code directly substitutes evaluated {{ ... }} template expressions into raw SQL query strings without using parameterized queries or prepared statements (CWE-89). Attack vector requires network access to an externally-reachable webhook trigger endpoint and low privileges (authenticated user able to create/modify workflows). An attacker can craft malicious input through webhook payloads that propagates into expressions, injecting SQL commands that execute with the MySQL database credentials' privileges. This enables data exfiltration, modification, or deletion. The vulnerability is remediated in n8n versions 1.123.61, 2.27.4, and 2.28.1. The MySQL v2 node uses parameterized queries and is not vulnerable. Temporary mitigations include disabling the MySQL v1 node, restricting workflow access, requiring webhook authentication, or migrating to MySQL v2.
Affected products
- n8n-io n8n < 1.123.61, 2.x < 2.27.4, 2.28.x < 2.28.1
Timeline
- 2026-06-24: disclosed: Original advisory GHSA-hwmj-qg4v-cvg9 published
- 2026-07-08: advisory: Duplicate advisory GHSA-2qp2-6frj-p9pq published
- 2026-07-22: other: Duplicate advisory GHSA-2qp2-6frj-p9pq withdrawn
- 2026-06-24: patched: Patches released: v1.123.61, v2.27.4, v2.28.1