CVE-2026-72750

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/n8n-io/n8n/security/advisories/GHSA-652q-gvq3-74qv	Mitigation Vendor Advisory
https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-executequery-operation	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:n8n:n8n:::::community:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:::::community:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:2.32.0::::community:node.js::*
	cpe:2.3:a:n8n:n8n:2.32.0::::enterprise:node.js::*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) n8n antes de 1.123.67, 2.31.5 y 2.32.1 contiene una vulnerabilidad de inyección SQL en la operación Execute Query del nodo Snowflake, que interpola valores de expresión directamente en la cadena SQL. Cuando un autor de flujo de trabajo incrusta datos de expresión no confiables y controlados externamente directamente en una consulta SQL sin procesar, esos datos no están parametrizados, lo que permite la inyección SQL. La solución añade un campo opcional Query Parameters para vincular valores a través de marcadores de posición posicionales.

Information

Published : 2026-08-11 13:19

Updated : 2026-10-29 20:17

NVD link : CVE-2026-72750

Mitre link : CVE-2026-72750

CVE.ORG link : CVE-2026-72750

JSON object : View

Products Affected

n8n

n8n

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-72750", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72750", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T19:26:25.928226Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "0", "lessThan": "1.123.67", "versionType": "semver"}, {"status": "unaffected", "version": "1.123.67", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "2.32.0", "lessThan": "2.32.1", "versionType": "semver"}, {"status": "unaffected", "version": "2.32.1", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "2.0.0-rc.0", "lessThan": "2.31.5", "versionType": "semver"}, {"status": "unaffected", "version": "2.31.5", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}]}], "published": "2026-08-11T13:19:06.097", "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-652q-gvq3-74qv", "tags": ["Mitigation", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-executequery-operation", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders."}, {"lang": "es", "value": "n8n antes de 1.123.67, 2.31.5 y 2.32.1 contiene una vulnerabilidad de inyecci\u00f3n SQL en la operaci\u00f3n Execute Query del nodo Snowflake, que interpola valores de expresi\u00f3n directamente en la cadena SQL. Cuando un autor de flujo de trabajo incrusta datos de expresi\u00f3n no confiables y controlados externamente directamente en una consulta SQL sin procesar, esos datos no est\u00e1n parametrizados, lo que permite la inyecci\u00f3n SQL. La soluci\u00f3n a\u00f1ade un campo opcional Query Parameters para vincular valores a trav\u00e9s de marcadores de posici\u00f3n posicionales."}], "lastModified": "2026-10-29T20:17:33.670", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "D963758D-5493-4A20-881B-DE05BAFAD896", "versionEndExcluding": "1.123.67"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "32A28E0A-5FBC-4C97-B443-540E01F80C8A", "versionEndExcluding": "1.123.67"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "AD768539-E781-401F-BE44-02E438BA9F6A", "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "969CE8A9-6759-4E7C-AC79-81FF38772F70", "versionEndExcluding": "2.31.5", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.32.0:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "A6AC605A-BDCF-4BFC-8B13-760CA2BD4C6C"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.32.0:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "20BD46BF-7D8F-4035-A8B9-E8338BF96909"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}