Is there a patch available for CVE-2026-56351?

Yes, a patch is available for CVE-2026-56351. Update the affected software to the latest version immediately.

n8n CVE-2026-56351

Q: What is the CVSS score of CVE-2026-56351?

CVE-2026-56351 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38753 MEDIUM

SQL Injection (CWE-89)

2026-06-24 VulnCheck

PostgreSQL SQLi Microsoft N8n

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network-accessible with low complexity; PR:L for required authenticated workflow-creator role; scope changes to downstream database (S:C) with high confidentiality and integrity impact; no availability impact described in the advisory.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 13:01 EUVD

Source Code Evidence Fetched

Jun 24, 2026 - 12:24 vuln.today

Analysis Generated

Jun 24, 2026 - 12:24 vuln.today

CVE Published

Jun 24, 2026 - 11:53 cve.org

MEDIUM 5.3

DescriptionCVE.org

n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.

AnalysisAI

SQL injection in n8n's MySQL, PostgreSQL, and Microsoft SQL database integration nodes (all versions before 2.4.0) allows authenticated users with workflow creation permissions to execute arbitrary SQL commands against connected databases by supplying crafted identifier values - table or column names - in node configuration parameters. The nodes failed to escape SQL identifiers when constructing queries, bypassing the safety guarantees users expected from parameterized inputs and enabling injection that directly impacts downstream database confidentiality and integrity. Reported by the NATO Cyber Security Centre; vendor-released patch is confirmed in n8n 2.4.0, with no public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) arising from a distinction between parameterized query values and SQL identifiers. Parameterized queries protect data values (WHERE col = ?) but do not protect structural identifiers such as table names and column names, which must be separately escaped using dialect-specific quoting (backtick-quoting in MySQL, double-quote escaping in PostgreSQL/MSSQL). n8n's mySql, postgres, and microsoftSql nodes passed user-controlled identifier values from node configuration parameters directly into query construction without applying identifier escaping or allowlisting. The affected package is npm/n8n (CPE: cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*) across all releases prior to 2.4.0. The patch is tracked at commit f73fae6fe7fc34907bba102648a9997186aa4385.

RemediationAI

The primary remediation is to upgrade n8n to version 2.4.0 or later, which resolves the identifier escaping flaw across all three affected database nodes (vendor advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-f3f2-mcxc-pwjx; patch commit: https://github.com/n8n-io/n8n/commit/f73fae6fe7fc34907bba102648a9997186aa4385). If immediate upgrade is not feasible, two interim workarounds are available per the vendor advisory: first, restrict workflow creation and editing permissions to fully trusted users only - this reduces the attack surface but does not fix the underlying code flaw and is ineffective if any trusted user is compromised; second, disable the three affected nodes by adding n8n-nodes-base.mySql, n8n-nodes-base.postgres, and n8n-nodes-base.microsoftSql to the NODES_EXCLUDE environment variable, which blocks exploitation entirely but also disables legitimate database integration functionality. Both workarounds are explicitly noted by the vendor as incomplete mitigations and should be treated as short-term measures only pending the upgrade to 2.4.0.