A serious security flaw has been found in n8n, a popular workflow automation tool. This vulnerability, identified as CVE-2026-59257, is a type of SQL injection. It affects older versions of n8n, specifically when using a particular database connector with its legacy settings. Attackers could exploit this to run harmful commands on your database, potentially leading to data theft, changes, or deletion.<\/p>\n
This vulnerability impacts the n8n<\/strong> workflow automation platform. It was officially published on July 8, 2026<\/strong>. The overall severity level assigned to this issue is HIGH<\/strong>, and its current status is Analyzed<\/strong>.<\/p>\n The SQL injection vulnerability affects specific versions of n8n:<\/p>\n The core of the problem lies within the legacy MySQL v1 node’s The vulnerability is currently in an Analyzed<\/strong> status. This means that the details of the flaw have been thoroughly investigated and understood by security researchers and the vendor.<\/p>\n With a CVSS score of 8.8, this vulnerability is rated as HIGH<\/strong> severity. A high severity rating indicates that exploiting this flaw could have a significant impact on the affected system. In this case, it means an attacker could potentially gain unauthorized access to, modify, or delete sensitive data stored in your MySQL database, leading to severe consequences for data confidentiality and integrity.<\/p>\n To protect your n8n installations from this SQL injection vulnerability, it is crucial to take immediate action:<\/p>\n Please note that these workarounds are temporary and do not eliminate the root cause of the vulnerability. Upgrading to a patched version or migrating to the MySQL v2 node is strongly recommended for long-term security.<\/p>\n<\/li>\n<\/ol>\n https:\/\/github.com\/n8n-io\/n8n\/security\/advisories\/GHSA-hwmj-qg4v-cvg9 Understanding the n8n SQL Injection Vulnerability A serious security flaw has been found in n8n, a popular workflow automation tool. This vulnerability, identified as CVE-2026-59257, is a type of SQL injection. It affects older versions of n8n, specifically when using a particular database connector with its legacy settings. Attackers could exploit this to run harmful […]<\/p>\n","protected":false},"author":17,"featured_media":3515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1067,1061,763,696,1068],"class_list":["post-3845","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-n8n","tag-node-js","tag-sql-injection","tag-vulnerability","tag-workflow-automation"],"blocksy_meta":[],"yoast_head":"\nAffected Products<\/h2>\n
\n
executeQuery<\/code> operation. This operation did not properly handle user-provided input, allowing malicious code to be inserted directly into SQL queries. If a workflow using this vulnerable operation was connected to an external trigger, such as a Webhook, it could become a target for attackers.<\/p>\nCurrent Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
\n
n8n-nodes-base.mySql<\/code> to your NODES_EXCLUDE<\/code> environment variable.<\/li>\nexecuteQuery<\/code> operation.<\/li>\nReferences<\/h2>\n
https:\/\/www.vulncheck.com\/advisories\/n8n-sql-injection-in-mysql-v1-executequery-operation-via-expression-interpolation<\/p>\n","protected":false},"excerpt":{"rendered":"