Is there a patch available for EUVD-2026-38470?

Yes, a patch is available for EUVD-2026-38470. Update the affected software to the latest version immediately.

n8n EUVD-2026-38470

Q: What is the CVSS score of EUVD-2026-38470?

EUVD-2026-38470 has a CVSS 4.0 base score of 6.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-54310 MEDIUM

SQL Injection (CWE-89)

2026-06-16 https://github.com/n8n-io/n8n

GHSA-c37g-w77q-m4vp

SQLi PostgreSQL

6.5

CVSS 4.0 · Vendor: https://github.com/n8n-io/n8n

Severity by source

Vendor (https://github.com/n8n-io/n8n) PRIMARY

6.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-accessible n8n web UI requires only low-privilege workflow editor role; SQL injection escapes application into database (S:C) yielding full CIA impact on database contents.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (https://github.com/n8n-io/n8n).

CVSS VectorVendor: https://github.com/n8n-io/n8n

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 23, 2026 - 17:07 NVD

9.9 (MEDIUM) 6.5 (MEDIUM)

Source Code Evidence Fetched

Jun 16, 2026 - 18:26 vuln.today

Analysis Generated

Jun 16, 2026 - 18:26 vuln.today

CVE Published

Jun 16, 2026 - 17:51 github-advisory

MEDIUM 9.9

DescriptionCVE.org

Impact

An authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account.

Patches

The issue has been fixed in n8n versions 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Limit workflow creation and editing permissions to fully trusted users only.
Disable the Postgres and TimescaleDB node by adding n8n-nodes-base.postgres, n8n-nodes-base.timescaleDb to the NODES_EXCLUDE environment variable.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

AnalysisAI

SQL injection in n8n's legacy Postgres v1 and TimescaleDB workflow nodes allows an authenticated workflow editor to inject and execute arbitrary SQL against the connected database, operating under the privileges of the configured database account. Affected versions span all n8n npm releases below 2.25.7 and the 2.26.0-2.26.1 range, with the CVSS 9.9 score reflecting a confirmed scope change: the injection escapes the n8n application layer into the underlying database system (S:C), enabling full confidentiality, integrity, and availability compromise of database contents. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege requirement and network-accessible attack vector make this a critical priority for any deployment where workflow editing access is broadly granted.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) present in two n8n workflow node implementations: the legacy 'Postgres v1' node (n8n-nodes-base.postgres) and the 'TimescaleDB' node (n8n-nodes-base.timescaleDb). TimescaleDB is a PostgreSQL extension/derivative, and both nodes share similar SQL construction patterns, suggesting a common root cause: user-supplied workflow parameters are interpolated directly into SQL query strings without adequate parameterization or input sanitization. The affected package is pkg:npm/n8n, confirming this is the core Node.js npm distribution of the n8n workflow automation platform. The CVSS scope change (S:C) is technically accurate because a successful SQL injection breaks the application-layer trust boundary, affecting the database server as a distinct security scope from the n8n runtime itself. Depending on the permissions of the configured database account, impact can extend to reading all accessible schemas, writing or truncating data, and - in over-privileged configurations - executing OS-level operations via PostgreSQL extensions such as pg_execute_server_program or COPY TO/FROM PROGRAM.

RemediationAI

The primary remediation is to upgrade n8n to version 2.25.7 or 2.26.2 (or any later release), as confirmed by the vendor advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-c37g-w77q-m4vp. Administrators running the 2.25.x branch should target 2.25.7; those on the 2.26.x branch should target 2.26.2. If immediate upgrade is not feasible, two temporary compensating controls are available: first, restrict workflow creation and editing permissions exclusively to fully trusted users - this narrows the attack surface but does not eliminate risk if a trusted account is compromised or acts maliciously, and has the operational trade-off of blocking legitimate workflow development; second, disable the Postgres v1 and TimescaleDB nodes by adding n8n-nodes-base.postgres and n8n-nodes-base.timescaleDb to the NODES_EXCLUDE environment variable - this eliminates the vulnerable code paths entirely but will break all existing workflows that depend on these nodes, requiring migration to unaffected node variants before re-enabling database connectivity. The vendor explicitly notes that neither workaround fully remediates the risk; both should be treated as short-term bridges to patching.