CVE-2026-72775

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.67 n8n versions prior to 2.31.5 n8n versions prior to 2.32.1

Description The PostgresTrigger node fails to properly escape user-supplied identifier parameters when interpolating them into SQL statements. This allows an authenticated user to perform a SQL injection, executing arbitrary SQL commands against the connected PostgreSQL database using the privileges of the configured credentials, which can result in full read and write access. The affected parameters are channel, function, and trigger names.

Recommendations Update to version 1.123.67 or later. Update to version 2.31.5 or later. Update to version 2.32.1 or later. As a temporary mitigation, restrict the use of the PostgresTrigger node.