CVE Intelligence
Analysis AI-assisted

CVE-2026-56351: n8n SQL Injection in MySQL, PostgreSQL and Microsoft SQL Nodes

CVE-2026-56351 affects n8n before version 2.4.0 and involves SQL injection in the MySQL, PostgreSQL and Microsoft SQL nodes, caused by unescaped identifier values in node configuration parameters. Authenticated users with workflow creation permissions may be able to influence table or column names to run unauthorized database commands. The record reports a CVSS 3.1 base score of 9.6 from NVD, and CISA KEV does not list this CVE.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-56351 is a SQL injection weakness (CWE-89) in the MySQL, PostgreSQL and Microsoft SQL nodes of n8n, a workflow automation platform. According to the record, identifier values such as table or column names in node configuration parameters are not escaped before being used in queries, affecting versions before 2.4.0.

Impact

  • The record describes unauthorized database command execution and a compromise of data integrity.
  • The attack is described as requiring an authenticated user with workflow creation permissions.
  • NVD scores the issue at 9.6 (CVSS 3.1, vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact.
  • A third-party score of 8.2 (CVSS 3.1) and a score of 5.3 (CVSS 4.0) are also recorded from the CNA.

Affected products and versions

  • n8n (product listed as N8n N8n) versions before 2.4.0.
  • The affected nodes are MySQL, PostgreSQL and Microsoft SQL.
  • The record does not provide a list of individual patched builds beyond the 2.4.0 threshold.

Exploitation status

CISA KEV does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. EPSS data is not available in the record.

Remediation and mitigation

  • Review the n8n advisory GHSA-f3f2-mcxc-pwjx, which is listed as a mitigation reference, and identify the guidance it provides.
  • Plan an upgrade to n8n 2.4.0 or later, since the record indicates versions before 2.4.0 are affected.
  • Limit workflow creation and editing permissions to trusted users until the upgrade is applied.
  • Review database accounts used by n8n connections and apply least privilege.

Detection guidance

  • Audit workflows for recently created or modified database nodes, especially those with unusual table or column identifiers.
  • Review database logs for unexpected queries originating from the n8n service account.
  • Monitor n8n audit logs for workflow changes made by low-privilege accounts.

Limitations of the available information

The record does not state the exact vulnerable parameters, the required database privileges, or whether a public proof of concept exists. Fixed build details beyond 2.4.0 and the full list of affected minor versions are not provided. Specific exploitation conditions are unknown.

Frequently asked questions

Which versions of n8n are affected by CVE-2026-56351?

The record lists n8n versions before 2.4.0 as affected.

Is CVE-2026-56351 known to be actively exploited?

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What is the required privilege level for this issue?

The record describes an authenticated user with workflow creation permissions. Exact privilege requirements beyond this are unknown.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.