CCB Alert@CCBalert
Warning: Critical SQL Injection in #n8n. #CVE-2026-110840 #CVE-2026-110847 CVSS: 9.8. These flaws can lead to unauthenticated remote database manipulation. #Patch #Patch #Patch
00000208
7.3K followersView on X
CVE-2026-110840
LOWCVSS 7.0 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-89
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day