SQL injection in n8n - CVE-2026-126381
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU163071
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126381
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to read data accessible to the configured Oracle credential through SQL injection.
The vulnerability exists due to missing validation of Metadata Filter keys in n8n's Vector Store (OracleDB) node when workflows pass untrusted input into those keys. An authenticated attacker can submit a crafted filter key through an input source such as a webhook to alter the vector search query and retrieve database data.
Affected software
n8n
How to mitigate CVE-2026-126381
Install security update from vendor's website.
n8n - addressed in versions 2.43.5, 2.44.1, 3.0.1