n8n: N8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and…
n8n
- Severity
- Critical, CVSS 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- Record
- CVE-2026-56351
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 24, 2026
- Source last modified
- June 26, 2026
Description
n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.
Description quoted from the NVD record.
Who is affected
This flaw affects n8n, a tool for automating tasks by linking apps and services into workflows. It affects versions before 2.4.0, in the building blocks that let a workflow work with MySQL, PostgreSQL and Microsoft SQL databases. A signed-in user who is allowed to create workflows could enter specially crafted table or column names that slip unauthorized commands into the database. This could let them run database commands they should not be able to run and damage the accuracy of your data. This flaw is rated Critical.
What to do
- Find out who installed or runs n8n for your organization. If it is someone on your staff or a volunteer, ask them to check which version of n8n is in use.
- If the version is earlier than
2.4.0, that person should update n8n to version2.4.0or later, which fixes this flaw in the database building blocks. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update to version
2.4.0or later will be done.
Analysis written from the source record as of June 26, 2026 and reviewed before publishing.