A serious security flaw has been found in n8n, a popular workflow automation platform. This vulnerability, identified as CVE-2026-72775, is a type of SQL injection. It affects the PostgresTrigger node<\/strong> within n8n. If exploited, an attacker could gain full control over your PostgreSQL database, including reading and writing all data. This is a significant concern for anyone using affected versions of n8n with a PostgreSQL database.<\/p>\n Product:<\/strong> n8n<\/p>\n Published:<\/strong> August 11, 2026<\/p>\n Severity:<\/strong> High<\/p>\n Status:<\/strong> Analyzed<\/p>\n This SQL injection vulnerability impacts specific versions of the n8n automation platform. Users running any of the following versions are at risk:<\/p>\n The core issue lies in how the PostgresTrigger node handles certain user-provided information. It fails to properly clean or “escape” parameters like channel, function, and trigger names before using them in SQL commands. This oversight allows a malicious authenticated user to insert their own SQL code, which the connected PostgreSQL database then executes with the privileges of the n8n credentials.<\/p>\n This vulnerability has been officially analyzed. Information regarding its nature and potential impact is available to the public. Organizations using n8n should take immediate action to address the risk.<\/p>\n The vulnerability has been assigned a High<\/strong> severity rating, with a CVSS score of 8.8. This high score indicates that exploiting this flaw could lead to significant damage. An attacker, once authenticated, could completely compromise the confidentiality, integrity, and availability of your connected PostgreSQL database. This means sensitive data could be stolen, altered, or made unavailable.<\/p>\n The good news is that fixes are available. To protect your n8n instances, it is crucial to update to the patched versions as soon as possible:<\/p>\n If an immediate upgrade isn’t feasible, consider these temporary workarounds:<\/p>\n Remember, these workarounds are only short-term measures. A full upgrade to a patched version is the most effective way to secure your system against this vulnerability.<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/security\/advisories\/GHSA-jqwr-vx3p-r266 Understanding the High Severity Risk in n8n A serious security flaw has been found in n8n, a popular workflow automation platform. This vulnerability, identified as CVE-2026-72775, is a type of SQL injection. It affects the PostgresTrigger node within n8n. If exploited, an attacker could gain full control over your PostgreSQL database, including reading and writing […]<\/p>\n","protected":false},"author":17,"featured_media":3515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1220,1067,1159,763,696],"class_list":["post-3938","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-automation","tag-n8n","tag-postgresql","tag-sql-injection","tag-vulnerability"],"blocksy_meta":[],"yoast_head":"\nCVE Details<\/h2>\n
Affected Products<\/h2>\n
\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
\n
n8n-nodes-base.postgresTrigger<\/code> to your NODES_EXCLUDE<\/code> environment variable.<\/li>\nReferences<\/h2>\n
\nhttps:\/\/www.vulncheck.com\/advisories\/n8n-before-sql-injection-via-postgrestrigger-node<\/p>\n","protected":false},"excerpt":{"rendered":"