EUVD-2026-42269
GHSA-2qp2-6frj-p9pq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required workflow configuration prerequisites (AT:P equivalent); scope change to MySQL database drives SC:H/SI:H; PR:N because externally-reachable Webhook requires no attacker credentials.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection, allowing execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node, which uses parameterized queries, is not affected.
AnalysisAI
SQL injection in n8n's legacy MySQL v1 node (executeQuery operation) exposes the connected MySQL database to arbitrary query execution when workflow expressions interpolate attacker-controlled input without parameterization. Versions before 1.123.61 (1.x branch), 2.27.4 (2.x branch), and 2.28.1 (2.28.x branch) are affected when workflows combine the MySQL v1 node with externally-reachable triggers such as a Webhook node. No public exploit or CISA KEV listing is identified at time of analysis; however, deployments exposing such workflows to untrusted networks face high-severity database confidentiality and integrity risk.
Technical ContextAI
n8n is an open-source workflow automation platform allowing users to chain triggers (e.g., Webhook nodes) with backend integrations (e.g., MySQL nodes) via a visual editor. The vulnerable component is the legacy MySQL v1 node's executeQuery operation, which uses n8n's {{ ... }} template expression syntax to substitute runtime values directly into a raw SQL string before execution - a classic string-concatenation anti-pattern that bypasses any form of query parameterization. CWE-89 (Improper Neutralization of Special Elements in an SQL Command) precisely identifies the root cause: user-controlled data flows into an SQL interpreter without sanitization or binding. The MySQL v2 node, which uses prepared statements with parameterized queries, is explicitly not affected. The CVSS 4.0 vector's AT:P (Attack Requirements: Present) metric confirms that exploitation requires a specific, non-default workflow configuration to be in place.
RemediationAI
Upgrade n8n to version 1.123.61 or later (1.x branch), 2.27.4 or later (2.x branch), or 2.28.1 or later (2.28.x branch) as confirmed by the vendor advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-hwmj-qg4v-cvg9. As a direct workaround, migrate all executeQuery operations from the MySQL v1 node to the MySQL v2 node, which uses parameterized queries and is not affected; this is the safest and most operationally sustainable remediation short of patching. If immediate patching or migration is not feasible, restrict access to Webhook trigger endpoints by enabling n8n's built-in webhook authentication or placing a reverse proxy with authentication in front of the instance, eliminating the external attacker-controlled input path; note this adds operational overhead for legitimate callers. As a last resort, disable or suspend any workflows that combine an externally-facing Webhook node with a MySQL v1 executeQuery node until the patch can be applied.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today