# n8n SQL injection in MySQL v1 node executeQuery operation

Source: https://junglewise.ai/threats/n8n-sql-injection-in-mysql-v1-node-executequery-operation-3d263f95  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.8 · Published 2026-07-08

n8n is a popular workflow automation tool used to connect different software services. A security flaw in its legacy MySQL connector allows attackers to run unauthorized database commands if a workflow is exposed to the internet (for example, via a Webhook). This could lead to the theft, modification, or deletion of sensitive data stored in the connected MySQL database.

Technologies: [N8n](https://junglewise.ai/threats/technologies/n8n). Vendors: [N8n](https://junglewise.ai/threats/vendors/n8n).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.8, published 8 July 2026.

**Which products and versions are affected?** N8n < 1.123.61, 2.x < 2.27.4, 2.28.x < 2.28.1.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a network appliance.

**Am I affected?** Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the legacy MySQL v1 node of n8n. The 'executeQuery' operation fails to properly parameterize values within '{{ ... }}' expressions, instead interpolating them directly into raw SQL strings. If a workflow utilizes this node with expression-sourced values and is triggered by an externally reachable source like a Webhook, an attacker can provide malicious input to execute arbitrary SQL commands. This exploit is limited to the privileges of the configured MySQL credentials. The issue is resolved in versions 1.123.61, 2.27.4, and 2.28.1; the MySQL v2 node is not affected as it uses parameterized queries.

## Affected products

- n8n-io n8n < 1.123.61, 2.x < 2.27.4, 2.28.x < 2.28.1

## Timeline

- 2026-06-24: advisory: Original advisory GHSA-hwmj-qg4v-cvg9 published
- 2026-07-08: disclosed: Duplicate advisory GHSA-2qp2-6frj-p9pq published
- 2026-07-22: other: Duplicate advisory withdrawn in favor of original GHSA-hwmj-qg4v-cvg9

## References

- [https://github.com/n8n-io/n8n/security/advisories/GHSA-hwmj-qg4v-cvg9](https://github.com/n8n-io/n8n/security/advisories/GHSA-hwmj-qg4v-cvg9)
- [https://www.vulncheck.com/advisories/n8n-sql-injection-in-mysql-v1-executequery-operation-via-expression-interpolation](https://www.vulncheck.com/advisories/n8n-sql-injection-in-mysql-v1-executequery-operation-via-expression-interpolation)

## Related threats

- [n8n path traversal in Databricks node](https://junglewise.ai/threats/cve-2026-119557-n8n-from-2-14-0-through-2-46-3-contains-a-path-traversal)
- [n8n remote code execution in deprecated Function nodes](https://junglewise.ai/threats/cve-2026-119408-n8n-before-2-42-6-2-43-x-before-2-43-3-and-3-x-before-3-0-1)
- [n8n Slack Trigger SSRF and token exfiltration](https://junglewise.ai/threats/cve-2026-118679-n8n-before-1-123-83-2-41-4-and-2-42-1-contains-a-server-side)
- [n8n prototype pollution in workflow history compaction](https://junglewise.ai/threats/cve-2026-118678-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-prototype)
- [n8n Local Gateway deep-link missing confirmation re-pairing](https://junglewise.ai/threats/cve-2026-118677-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-missing)