N8n EUVD-2026-15947

Requires authenticated n8n user with workflow creation/modification permissions. Attacker exploits SQL injection in Data Table Get node. SQLite deployments have limited impact (single statements only). PostgreSQL deployments allow multi-statement execution enabling data modification/deletion. Affects n8n versions before 1.123.26, 2.13.3, and 2.14.1.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/PR:L/UI:N indicates this is a remotely exploitable vulnerability with low attack complexity requiring only low-level authenticated privileges and no user interaction, presenting a significant risk profile. However, the real-world risk is substantially moderated by the requirement for authenticated access with workflow creation permissions, limiting the attack surface to insider threats or compromised accounts. The critical distinction between SQLite (limited impact) and PostgreSQL (full data compromise) deployments means risk assessment must be environment-specific. Without EPSS data, KEV listing, or public POC availability, this appears to be a high-CVSS issue requiring priority attention primarily for PostgreSQL deployments with multiple or less-trusted authenticated users, while SQLite installations face comparatively lower practical risk. The availability of patches across multiple version branches (1.x, 2.13.x, 2.14.x) and comprehensive workarounds suggests this should be prioritized for remediation but does not indicate imminent widespread exploitation.

An authenticated attacker with workflow creation privileges crafts a malicious n8n workflow containing a Data Table Get node with a specially crafted orderByColumn expression that injects SQL commands. On a PostgreSQL-backed n8n instance, the attacker executes the workflow to perform stacked SQL queries that exfiltrate sensitive workflow data, modify user permissions in the database, or delete critical configuration tables, potentially compromising the entire n8n deployment and any connected systems accessible through stored credentials. The low attack complexity means exploitation requires only basic SQL injection knowledge and legitimate authenticated access.