n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the Oracle Database node's select…
n8n
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-42233
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 4, 2026
- Source last modified
- June 17, 2026
Description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the Oracle Database node's select operation allowed user-controlled input passed into the Limit field via expressions to be interpolated directly into the SQL query without sanitization or parameterization. In workflows where external input is passed into the Limit field (e.g., from a webhook), an attacker could inject arbitrary SQL and exfiltrate data from the connected Oracle database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
Description quoted from the NVD record.
Who is affected
This flaw affects n8n, a tool for connecting different apps and services and automating tasks between them. It affects versions before 1.123.32, 2.17.4 and 2.18.1. The problem is in the building block that reads data from an Oracle database, specifically the field that sets how many rows to return. If a workflow passes outside input into that field, for example information arriving in an incoming web request, an attacker could slip in their own database commands and copy data out of the connected Oracle database. This flaw is rated Critical.
What to do
- Find out who runs n8n for your organization: the person who installed it, or the IT provider or vendor who manages it for you.
- If someone in your organization runs it, ask them to check which version is installed and update to
1.123.32,2.17.4or2.18.1, choosing the fixed version that matches the version series you use, or any later release. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- Until the update is done, ask whoever runs n8n whether any workflow reads from an Oracle database and passes outside input into the field that sets how many rows to return. Those workflows are the ones at risk.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.