n8n SQL Injection Vulnerability (CVE-2026-59257) — High Severity

Understanding the n8n SQL Injection Vulnerability

A serious security flaw has been found in n8n, a popular workflow automation tool. This vulnerability, identified as CVE-2026-59257, is a type of SQL injection. It affects older versions of n8n, specifically when using a particular database connector with its legacy settings. Attackers could exploit this to run harmful commands on your database, potentially leading to data theft, changes, or deletion.

CVE Details

This vulnerability impacts the n8n workflow automation platform. It was officially published on July 8, 2026. The overall severity level assigned to this issue is HIGH, and its current status is Analyzed.

Affected Products

The SQL injection vulnerability affects specific versions of n8n:

• n8n versions prior to 1.123.61
• n8n 2.x versions prior to 2.27.4
• n8n 2.28.x versions prior to 2.28.1

The core of the problem lies within the legacy MySQL v1 node’s executeQuery operation. This operation did not properly handle user-provided input, allowing malicious code to be inserted directly into SQL queries. If a workflow using this vulnerable operation was connected to an external trigger, such as a Webhook, it could become a target for attackers.

Current Status

The vulnerability is currently in an Analyzed status. This means that the details of the flaw have been thoroughly investigated and understood by security researchers and the vendor.

Severity Level

With a CVSS score of 8.8, this vulnerability is rated as HIGH severity. A high severity rating indicates that exploiting this flaw could have a significant impact on the affected system. In this case, it means an attacker could potentially gain unauthorized access to, modify, or delete sensitive data stored in your MySQL database, leading to severe consequences for data confidentiality and integrity.

Possible Solutions

To protect your n8n installations from this SQL injection vulnerability, it is crucial to take immediate action:

1. Upgrade n8n: The most effective solution is to update your n8n instance to a patched version. The issue has been fixed in versions 1.123.61, 2.27.4, and 2.28.1, or any later releases. Always ensure your software is up to date.
2. Migrate to MySQL v2 Node: The MySQL v2 node is not affected by this vulnerability as it uses parameterized queries, which correctly separate code from data. If you are using the legacy MySQL v1 node, migrate your workflows to use the more secure MySQL v2 node.
3. Apply Temporary Mitigations (if immediate upgrade is not possible):
   • Disable the problematic MySQL v1 node by adding n8n-nodes-base.mySql to your NODES_EXCLUDE environment variable.
   • Carefully audit and restrict access to any workflows that still use the MySQL v1 node with the executeQuery operation.
   • Ensure that any webhook endpoints connected to workflows with vulnerable MySQL v1 nodes require strong authentication.

   Please note that these workarounds are temporary and do not eliminate the root cause of the vulnerability. Upgrading to a patched version or migrating to the MySQL v2 node is strongly recommended for long-term security.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-hwmj-qg4v-cvg9
https://www.vulncheck.com/advisories/n8n-sql-injection-in-mysql-v1-executequery-operation-via-expression-interpolation