EUVD-2026-42269
GHSA-2qp2-6frj-p9pq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required workflow configuration prerequisites (AT:P equivalent); scope change to MySQL database drives SC:H/SI:H; PR:N because externally-reachable Webhook requires no attacker credentials.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection, allowing execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node, which uses parameterized queries, is not affected.
AnalysisAI
SQL injection in n8n's legacy MySQL v1 node (executeQuery operation) exposes the connected MySQL database to arbitrary query execution when workflow expressions interpolate attacker-controlled input without parameterization. Versions before 1.123.61 (1.x branch), 2.27.4 (2.x branch), and 2.28.1 (2.28.x branch) are affected when workflows combine the MySQL v1 node with externally-reachable triggers such as a Webhook node. No public exploit or CISA KEV listing is identified at time of analysis; however, deployments exposing such workflows to untrusted networks face high-severity database confidentiality and integrity risk.
Technical ContextAI
n8n is an open-source workflow automation platform allowing users to chain triggers (e.g., Webhook nodes) with backend integrations (e.g., MySQL nodes) via a visual editor. The vulnerable component is the legacy MySQL v1 node's executeQuery operation, which uses n8n's {{ ... }} template expression syntax to substitute runtime values directly into a raw SQL string before execution - a classic string-concatenation anti-pattern that bypasses any form of query parameterization. CWE-89 (Improper Neutralization of Special Elements in an SQL Command) precisely identifies the root cause: user-controlled data flows into an SQL interpreter without sanitization or binding. The MySQL v2 node, which uses prepared statements with parameterized queries, is explicitly not affected. The CVSS 4.0 vector's AT:P (Attack Requirements: Present) metric confirms that exploitation requires a specific, non-default workflow configuration to be in place.
RemediationAI
Upgrade n8n to version 1.123.61 or later (1.x branch), 2.27.4 or later (2.x branch), or 2.28.1 or later (2.28.x branch) as confirmed by the vendor advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-hwmj-qg4v-cvg9. As a direct workaround, migrate all executeQuery operations from the MySQL v1 node to the MySQL v2 node, which uses parameterized queries and is not affected; this is the safest and most operationally sustainable remediation short of patching. If immediate patching or migration is not feasible, restrict access to Webhook trigger endpoints by enabling n8n's built-in webhook authentication or placing a reverse proxy with authentication in front of the instance, eliminating the external attacker-controlled input path; note this adds operational overhead for legitimate callers. As a last resort, disable or suspend any workflows that combine an externally-facing Webhook node with a MySQL v1 executeQuery node until the patch can be applied.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
The n8n package 0.218.0 for Node.js allows Directory Traversal. Rated medium severity (CVSS 6.5), this vulnerability is
n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allow
This vulnerability in n8n (an open-source workflow automation platform) is an authentication bypass in the OAuth callbac
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary c
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today