N8N · N8N · CVE-2026-56351
**Name of the Vulnerable Software and Affected Versions**
n8n versions prior to 2.4.0
**Description**
Authenticated users with workflow creation permissions can inject arbitrary SQL through unescaped identifier values in node configuration parameters. This occurs because the MySQL, PostgreSQL, and Microsoft SQL nodes do not escape identifier values when constructing queries, allowing attackers to supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.
**Recommendations**
Update to version 2.4.0 or later.
Limit workflow creation and editing permissions to fully trusted users only.
Disable the MySQL, PostgreSQL, and Microsoft SQL nodes by adding `n8n-nodes-base.mySql`, `n8n-nodes-base.postgres`, and `n8n-nodes-base.microsoftSql` to the `NODES EXCLUDE` environment variable.