n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-59257
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 8, 2026
- Source last modified
- October 25, 2026
Description
n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection, allowing execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node, which uses parameterized queries, is not affected.
Description quoted from the NVD record.
Who is affected
n8n is a tool for connecting apps and automating tasks between them. This flaw affects n8n versions before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1. The problem is in the older version 1 MySQL building block, in its option to run a custom database query. It matters when a workflow uses that option with values filled in from expressions and is started by something reachable from outside, such as a webhook. An attacker could then run any database commands that the connected MySQL account is allowed to run. The newer version 2 MySQL building block is not affected. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should find out which version is in use.
- Update n8n to a fixed release:
1.123.61if you are on the 1.x line,2.27.4if you are on 2.x before 2.28, or2.28.1if you are on 2.28.x. - Until the update is done, ask that person to check whether any workflow uses the older version 1 MySQL building block to run custom queries and is started from outside, such as by a webhook. Those workflows are the ones at risk.
- If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.