SQL injection in n8n - #VU139116
Published: July 22, 2026
Vulnerability identifier: #VU139116
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: n8n
Affected software:
n8n
n8n
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary SQL on connected PostgreSQL instances.
The vulnerability exists due to sql injection in the Postgres Trigger node when processing user-supplied identifier parameters. A remote user can supply crafted channel, function, or trigger names to execute arbitrary SQL on connected PostgreSQL instances.
Injected SQL is executed with the privileges of the configured PostgreSQL credentials, which can result in full read and write access to the connected database.
Remediation
Install security update from vendor's website.