n8n SQL Injection Vulnerability (CVE-2026-72775) — High Severity

Understanding the High Severity Risk in n8n

A serious security flaw has been found in n8n, a popular workflow automation platform. This vulnerability, identified as CVE-2026-72775, is a type of SQL injection. It affects the PostgresTrigger node within n8n. If exploited, an attacker could gain full control over your PostgreSQL database, including reading and writing all data. This is a significant concern for anyone using affected versions of n8n with a PostgreSQL database.

CVE Details

Product: n8n

Published: August 11, 2026

Severity: High

Status: Analyzed

Affected Products

This SQL injection vulnerability impacts specific versions of the n8n automation platform. Users running any of the following versions are at risk:

  • n8n versions before 1.123.67
  • n8n versions before 2.31.5
  • n8n versions before 2.32.1

The core issue lies in how the PostgresTrigger node handles certain user-provided information. It fails to properly clean or “escape” parameters like channel, function, and trigger names before using them in SQL commands. This oversight allows a malicious authenticated user to insert their own SQL code, which the connected PostgreSQL database then executes with the privileges of the n8n credentials.

Current Status

This vulnerability has been officially analyzed. Information regarding its nature and potential impact is available to the public. Organizations using n8n should take immediate action to address the risk.

Severity Level

The vulnerability has been assigned a High severity rating, with a CVSS score of 8.8. This high score indicates that exploiting this flaw could lead to significant damage. An attacker, once authenticated, could completely compromise the confidentiality, integrity, and availability of your connected PostgreSQL database. This means sensitive data could be stolen, altered, or made unavailable.

Possible Solutions

The good news is that fixes are available. To protect your n8n instances, it is crucial to update to the patched versions as soon as possible:

  • Upgrade to n8n version 1.123.67 or later.
  • Upgrade to n8n version 2.31.5 or later.
  • Upgrade to n8n version 2.32.1 or later.

If an immediate upgrade isn’t feasible, consider these temporary workarounds:

  • Limit Access: Ensure that only fully trusted users have access to your n8n instance.
  • Disable Node: Temporarily disable the PostgresTrigger node by adding n8n-nodes-base.postgresTrigger to your NODES_EXCLUDE environment variable.
  • Minimize Privileges: Configure your PostgreSQL database credentials used with n8n to have the absolute minimum necessary permissions. Avoid using SUPERUSER roles for n8n connections.

Remember, these workarounds are only short-term measures. A full upgrade to a patched version is the most effective way to secure your system against this vulnerability.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-jqwr-vx3p-r266
https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-postgrestrigger-node

Tags
Alex Joseph
Alex Joseph

Alex Joseph is a Senior Support Staff professional with deep experience in server management, web hosting technologies, and cybersecurity operations. He works daily with Linux servers, cloud platforms, performance tuning, and security hardening, giving him strong real-world technical knowledge. Along with his support role, he write about security best practices, hosting infrastructure, and software management.

Related Posts