n8n: N8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-72750
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 11, 2026
- Source last modified
- October 24, 2026
Description
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders.
Description quoted from the NVD record.
Who is affected
n8n is a tool for connecting different apps and automating tasks between them. This flaw affects versions before 1.123.67, 2.31.5 and 2.32.1. The problem is in the building block that connects workflows to Snowflake databases, specifically when it runs a custom database query. If someone who builds workflows puts outside data that cannot be trusted straight into such a query, an attacker could slip their own database commands into it. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should handle this. If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- Update n8n to version
1.123.67,2.31.5or2.32.1(or later), whichever matches the release line you use. - After updating, ask the people who build your workflows to find any that send custom queries to Snowflake using outside data.
- In those workflows, use the new optional Query Parameters field to pass in outside data instead of placing it directly in the query text.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.