CVE-2026-56351

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.4.0

Description Authenticated users with workflow creation permissions can inject arbitrary SQL through unescaped identifier values in node configuration parameters. This occurs because the MySQL, PostgreSQL, and Microsoft SQL nodes do not escape identifier values when constructing queries, allowing attackers to supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.

Recommendations Update to version 2.4.0 or later. Limit workflow creation and editing permissions to fully trusted users only. Disable the MySQL, PostgreSQL, and Microsoft SQL nodes by adding n8n-nodes-base.mySql, n8n-nodes-base.postgres, and n8n-nodes-base.microsoftSql to the NODES EXCLUDE environment variable.