CVE-2026-59257

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.61 n8n versions prior to 2.27.4 n8n versions 2.28.0 through 2.28.0

Description A SQL injection issue exists in the legacy MySQL v1 node during the executeQuery operation. The system substitutes evaluated {{ ... }} expression values directly into the raw SQL string without using parameterization. If a workflow utilizes this operation with expression-sourced values and is linked to an externally-reachable trigger, such as a Webhook node, an attacker can provide malicious input to execute arbitrary SQL commands using the privileges of the configured MySQL credentials.

Recommendations Update to version 1.123.61 or later. Update to version 2.27.4 or later. Update to version 2.28.1 or later. As a temporary mitigation, avoid using the executeQuery operation in the legacy MySQL v1 node or restrict the use of expression-sourced values in that operation.