n8n SQL injection in PostgresTrigger node

Executive brief

n8n is a workflow automation tool used to connect various software services. A vulnerability in its PostgreSQL integration allows authorized users to run unauthorized database commands. This could lead to an attacker reading, modifying, or deleting sensitive data stored in any PostgreSQL database connected to the n8n platform.

Technical details

A SQL injection vulnerability exists in the n8n PostgresTrigger node due to improper escaping of user-supplied identifier parameters, including channel, function, and trigger names. These parameters are interpolated directly into SQL statements. An authenticated attacker with network access to the n8n instance can exploit this to execute arbitrary SQL commands on the connected PostgreSQL database. The commands execute with the privileges of the configured database credentials. The issue is fixed in versions 1.123.67, 2.31.5, and 2.32.1.

Affected products

• n8n-io n8n < 1.123.67, >= 2.0.0-rc.0 < 2.31.5, >= 2.32.0 < 2.32.1

Timeline

• 2026-07-22: disclosed
• 2026-07-22: patched
• 2026-07-22: advisory

References

• https://api.github.com/users/sm1ee
• https://github.com/sm1ee
• https://api.github.com/users/sm1ee/gists%7B/gist_id%7D
• https://api.github.com/users/sm1ee/repos
• https://avatars.githubusercontent.com/u/19336661?v=4
• https://api.github.com/users/sm1ee/events%7B/privacy%7D