CVE Intelligence
Analysis AI-assisted

CVE-2026-44792: n8n SQL Injection via Source Control Data Table Import

CVE-2026-44792 is a critical SQL injection flaw (CWE-89) in n8n, an open source workflow automation platform. An attacker with write access to a connected Source Control git repository could plant a crafted Data Table JSON file that is processed when an administrator runs a Source Control Pull, affecting instances that use PostgreSQL. Fixed versions are 1.123.43, 2.20.7 and 2.22.1, and the record shows no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

n8n is an open source workflow automation platform. CVE-2026-44792 is classified as SQL injection (CWE-89). According to the GitHub advisory, the flaw can be reached through the Source Control feature: a Data Table JSON file with a crafted column name, committed to a connected git repository, is imported when an administrator performs a Source Control Pull.

Impact

  • The record states that the flaw could lead to SQL injection on the internal PostgreSQL instance.
  • NVD lists a CVSS 3.1 base score of 9.0 (critical), and the GitHub CNA lists a CVSS 4.0 score of 8.9.
  • The record does not describe the data or privileges an attacker could reach beyond the database.

Affected products and versions

  • Product: n8n (listed as N8n N8n).
  • Affected ranges in the record: versions before 1.123.43; versions from 2.0.0 up to but not including 2.20.7; and versions from 2.21.0 up to but not including 2.22.1.
  • Fixed versions: 1.123.43, 2.20.7 and 2.22.1.

Exploitation status

  • The record shows the vulnerability is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • Exploitation requires PostgreSQL as the database backend, Source Control enabled, write access to the connected repository, and an administrator triggering a Source Control Pull.

Remediation and mitigation

  • Upgrade n8n to 1.123.43, 2.20.7 or 2.22.1, depending on the release line in use. The vendor advisory is the primary reference for the fix.
  • Until upgrading, restrict write access to repositories connected to Source Control and review recent commits to those repositories.
  • Treat Source Control Pull operations as sensitive: confirm the content of incoming Data Table files before an administrator imports them.
  • If the Source Control feature is not needed, disabling it removes the import path described in the advisory.

Detection guidance

  • Review repository history for recently added or modified Data Table JSON files, especially column names that look unusual or non-standard.
  • Audit logs of Source Control Pull operations and correlate them with repository changes made by unexpected accounts.
  • Monitor the PostgreSQL instance for unexpected query errors or database activity originating from the n8n service.

Limitations of the available information

  • The record does not provide proof-of-concept details, and no public exploit information is included in the sources consulted.
  • EPSS and SSVC data are not available in the record.
  • The record does not detail the exact impact on data confidentiality or integrity inside the database.
  • Whether any instance has already been compromised is unknown.

Frequently asked questions

What is CVE-2026-44792?

It is a critical SQL injection vulnerability (CWE-89) in n8n, triggered through a malicious Data Table JSON file imported during a Source Control Pull.

Which n8n versions are fixed?

The record lists fixed versions 1.123.43, 2.20.7 and 2.22.1. Upgrade to the fixed release on your version line.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.