A serious security flaw has been found in n8n, a popular open-source platform for automating workflows. This vulnerability, identified as CVE-2026-44792, could allow an unauthorized person to gain control over your n8n database, potentially leading to data theft or system disruption.
Specifically, if an attacker has write access to a Git repository connected to your n8n setup, they could sneak in a specially crafted Data Table JSON file. When an administrator later pulls changes from this repository, n8n would import the malicious file. This action could then trigger an SQL injection attack against the internal PostgreSQL database used by n8n.
CVE Details
- Product: n8n workflow automation platform
- Published Date: June 23, 2026
- Severity: CRITICAL
- Status: Analyzed
Affected Products
This vulnerability impacts n8n versions prior to:
- 1.123.43
- 2.22.1
- 2.20.7
It is crucial to note that exploitation is only possible if your n8n instance uses PostgreSQL as its database, the Source Control feature is active and linked to a repository an attacker can write to, and an administrator initiates a Source Control Pull.
Current Status
The vulnerability has been thoroughly analyzed, and patches are readily available to address the issue.
Severity Level
Rated as CRITICAL, this vulnerability indicates a very high potential for severe impact. A successful exploitation could lead to full compromise of the n8n database, allowing attackers to read, modify, or delete sensitive data, and potentially take control of the entire n8n instance. This level of severity demands immediate attention and remediation.
Possible Solutions
To protect your n8n instance from this SQL injection vulnerability, it is highly recommended to take the following actions:
Apply Patches:
Update your n8n installation to one of the patched versions or newer:
- Version 1.123.43
- Version 2.22.1
- Version 2.20.7
Temporary Mitigations (if immediate upgrade is not possible):
- Disable Source Control: If the Source Control feature is not essential for your current operations, consider disabling it temporarily.
- Restrict Git Access: Ensure that only highly trusted individuals have write access to any Git repositories connected to your n8n Source Control configuration.
- Caution with Pulls: Avoid performing Source Control Pulls from repositories that may have been modified by untrusted or unverified sources.
These temporary measures reduce risk but do not eliminate the vulnerability. Prioritize updating to a patched version as soon as possible.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-mhrx-qhrj-673w
