n8n: N8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-72775
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 11, 2026
- Source last modified
- October 24, 2026
Description
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by linking apps and services together into workflows. This flaw affects versions before 1.123.67, 2.31.5 and 2.32.1. The problem is in the building block that starts workflows from a PostgreSQL database (a common type of database). Anyone with a login to n8n could slip their own database commands into the names entered in this building block. Those commands would run against the connected PostgreSQL database with the permissions of the saved database login, allowing full read and write access. This flaw is rated High.
What to do
- Find out whether your organization uses n8n and who looks after it: the person who installed or runs it, or an IT provider or vendor.
- If someone in your organization runs n8n, they should update it to version
1.123.67,2.31.5or2.32.1, or any later release. These versions fix this flaw. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- For details on the fixed releases, see the vendor advisory linked on this page.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.