n8n SQL Injection Vulnerability (CVE-2026-54310) — Critical Severity

Unpacking the n8n SQL Injection Vulnerability

A critical security flaw has been identified in n8n, an open-source platform that helps you automate workflows. This vulnerability, tracked as CVE-2026-54310, could allow an attacker to gain significant control over your connected databases. It’s important for all users to understand this risk and take immediate action to protect their systems.

In simple terms, if you have an authenticated user who can create or change workflows in n8n, they could trick the system. By using specially made inputs in the TimescaleDB or older Postgres v1 nodes, they could inject malicious SQL code. This code would then run against your connected database, essentially doing whatever the database user account is allowed to do. This means a malicious insider or an attacker who gains access to a lower-privileged n8n account could potentially access, change, or delete sensitive data in your database.

CVE Details

• Product: n8n
• Published Date: June 23, 2026
• Severity: CRITICAL
• Status: Analyzed

Affected Products

This SQL Injection vulnerability impacts versions of n8n prior to 2.25.7 and 2.26.2. If you are running any version older than these, your system is at risk.

Current Status

The vulnerability has been thoroughly analyzed, and the necessary patches have been released by the n8n team. This means that while the threat was serious, a fix is readily available.

Severity Level

CVE-2026-54310 is rated as CRITICAL with a CVSS v3.1 score of 9.9. A critical rating indicates a severe vulnerability that can be exploited remotely with low complexity, requiring minimal or no user interaction, and leading to high impact on confidentiality, integrity, and availability of the affected system. In this case, it means an attacker could potentially steal sensitive data, alter crucial information, or even make your database unavailable.

Possible Solutions

The most effective way to protect your n8n installation from this vulnerability is to upgrade to a patched version immediately.

• Upgrade: Update your n8n instance to version 2.25.7 or 2.26.2, or any later release. These versions contain the necessary fixes to close this security loophole.

If an immediate upgrade is not feasible, consider these temporary mitigation steps:

• Limit Permissions: Restrict who can create or modify workflows in n8n. Only fully trusted users should have these permissions.
• Disable Vulnerable Nodes: You can disable the problematic TimescaleDB and Postgres v1 nodes by adding n8n-nodes-base.postgres and n8n-nodes-base.timescaleDb to your NODES_EXCLUDE environment variable. Please note that disabling these nodes might affect some of your workflows if they rely on these integrations.

These workarounds are temporary and should not replace a full upgrade. Always prioritize updating to the latest secure version of n8n.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-c37g-w77q-m4vp