SQL injection in n8n - CVE-2026-42237
Published: April 23, 2026
Vulnerability identifier: #VU127222
CSH Severity: Medium
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42237
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information or modify data in the connected database.
The vulnerability exists due to SQL injection in the Snowflake node and legacy MySQL v1 node when processing user-controlled input in identifier fields such as table name, column name, or update key via expressions. A remote user can send crafted input to inject SQL statements and disclose sensitive information or modify data in the connected database.
Exploitation requires a workflow configuration that passes user-controlled input into identifier fields via expressions.
Affected software
n8n
How to mitigate CVE-2026-42237
Install security update from vendor's website.
n8n - addressed in versions 1.123.32, 2.17.4, 2.18.1