CVE-2026-103253

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0

Description An SQL injection issue exists in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes into the table or schema fields to append arbitrary SQL statements. This allows the execution of Data Definition Language (DDL) commands, which modify database structures, or Data Manipulation Language (DML) commands, which modify data, against the connected database using the privileges of the provided credentials.

Recommendations Update n8n to version 1.123.80 or later. Update n8n to version 2.39.6 or later. Update n8n to version 2.40.1 or later. Restrict the use of the table and schema fields in the Oracle Database node's Delete Table Drop operation until the updates are applied.