n8n SQL Injection Vulnerability (CVE-2026-56351) — High Severity

Understanding the Threat

A serious security flaw, identified as CVE-2026-56351, has been discovered in n8n, a popular workflow automation platform. This vulnerability allows for SQL injection, which could enable unauthorized database commands and compromise data integrity. This issue impacts n8n versions released before 2.4.0, specifically affecting its MySQL, PostgreSQL, and Microsoft SQL nodes.

At its core, SQL injection is a technique where malicious SQL code is inserted into input fields to manipulate a database. In this case, authenticated users with the ability to create or modify workflows in n8n could exploit this by crafting special table or column names. Because the affected database nodes did not properly escape these identifier values, attackers could inject arbitrary SQL commands. This means sensitive data could be exposed, altered, or even deleted without authorization.

CVE Details

• Product: n8n
• Published: June 24, 2026
• Severity: High
• Status: Analyzed

Affected Products

The vulnerability impacts n8n versions prior to 2.4.0. If you are running any version older than 2.4.0, your system is at risk.

Current Status

The vulnerability has been thoroughly analyzed, and a resolution is available. Developers of n8n have released a patch to address this critical flaw.

Severity Level

This SQL injection vulnerability is rated with a High severity, carrying a CVSS score of 8.2. A high severity rating indicates that the vulnerability could lead to significant unauthorized access, modification, or destruction of data. It poses a substantial risk to the confidentiality and integrity of information stored in connected databases if exploited.

Possible Solutions

To secure your n8n instance against CVE-2026-56351, it is crucial to take immediate action:

Patching and Upgrades

• The primary solution is to upgrade your n8n instance to version 2.4.0 or later. This version includes the necessary fixes to properly escape identifier values in MySQL, PostgreSQL, and Microsoft SQL nodes, preventing SQL injection.

Temporary Mitigations (Workarounds)

If an immediate upgrade is not feasible, consider implementing these temporary workarounds. However, be aware that these do not fully eliminate the risk and should only be used as a short-term measure:

• Restrict Permissions: Limit workflow creation and editing permissions strictly to fully trusted users only. This reduces the attack surface by ensuring only authorized individuals can potentially introduce malicious workflows.
• Disable Vulnerable Nodes: You can disable the affected database nodes by modifying the NODES_EXCLUDE environment variable. Add the following values to exclude them:
  • n8n-nodes-base.mySql
  • n8n-nodes-base.postgres
  • n8n-nodes-base.microsoftSql

  Disabling these nodes will prevent their use in workflows, thereby mitigating the specific injection vector.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-f3f2-mcxc-pwjx
• https://www.vulncheck.com/advisories/n8n-sql-injection-in-mysql-postgresql-and-microsoft-sql-nodes