Executive brief
n8n is a popular workflow automation tool used to connect different software services. A security flaw in its legacy MySQL connector allows attackers to run unauthorized database commands if a workflow is exposed to the internet (for example, via a Webhook). This could lead to the theft, modification, or deletion of sensitive data stored in the connected MySQL database.
Technical details
A SQL injection vulnerability exists in the legacy MySQL v1 node of n8n. The 'executeQuery' operation fails to properly parameterize values within '{{ ... }}' expressions, instead interpolating them directly into raw SQL strings. If a workflow utilizes this node with expression-sourced values and is triggered by an externally reachable source like a Webhook, an attacker can provide malicious input to execute arbitrary SQL commands. This exploit is limited to the privileges of the configured MySQL credentials. The issue is resolved in versions 1.123.61, 2.27.4, and 2.28.1; the MySQL v2 node is not affected as it uses parameterized queries.
Affected products
- n8n-io n8n < 1.123.61, 2.x < 2.27.4, 2.28.x < 2.28.1
Timeline
- 2026-06-24: advisory: Original advisory GHSA-hwmj-qg4v-cvg9 published
- 2026-07-08: disclosed: Duplicate advisory GHSA-2qp2-6frj-p9pq published
- 2026-07-22: other: Duplicate advisory withdrawn in favor of original GHSA-hwmj-qg4v-cvg9