SQL injection in n8n - #VU127222
Published: April 23, 2026
Vulnerability identifier: #VU127222
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: n8n
Affected software:
n8n
n8n
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information or modify data in the connected database.
The vulnerability exists due to SQL injection in the Snowflake node and legacy MySQL v1 node when processing user-controlled input in identifier fields such as table name, column name, or update key via expressions. A remote user can send crafted input to inject SQL statements and disclose sensitive information or modify data in the connected database.
Exploitation requires a workflow configuration that passes user-controlled input into identifier fields via expressions.
Remediation
Install security update from vendor's website.