n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes
n8n
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-54310
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 26, 2026
Description
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account. This vulnerability is fixed in 2.25.7 and 2.26.2.
Description quoted from the NVD record.
Who is affected
This flaw affects n8n, a tool for automating tasks by connecting different apps and services into workflows. It affects versions before 2.25.7 and 2.26.2. The problem is in two building blocks that let a workflow work with a database: the TimescaleDB building block and the older version 1 of the Postgres building block. A person who can sign in and has permission to create or change workflows could send specially crafted input that runs database commands of their choice on the connected database, with whatever access the database account set up in n8n has. This flaw is rated Critical.
What to do
- The person who installed or runs n8n for your organization should act on this. If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- Update n8n to version
2.25.7or2.26.2, the versions that fix this flaw. - If your workflows use the TimescaleDB building block or the older version 1 of the Postgres building block, treat the update as urgent, since those are the parts with the problem.
- If you are not sure which building blocks your workflows use, update anyway, since the fixed versions are the named fix for this flaw.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.