🚨 HIGH - n8n SQL injection via unescaped identifiers in DB workflow nodes (CVE-2026-56351) n8n before 2.4.0 is vulnerable to SQL injection in its MySQL, PostgreSQL, and Microsoft SQL workflow nodes due to improper escaping of identifier values (e.g., table/column names) in node configuration. The root cause is improper input validation/escaping of SQL identifiers, allowing attacker-controlled identifiers to be interpreted as executable SQL. An authenticated user who can create or modify workflows can supply crafted table or column names to inject arbitrary SQL through these nodes and run unauthorized database commands. Impact includes unauthorized data modification/deletion, potential data exposure, and broader compromise of downstream systems relying on the affected database. 👉 Affected: n8n < 2.4.0 | Upgrade to 2.4.0
Post summary
The post announces an SQL injection vulnerability (CVE‑2026‑56351) in n8n workflow nodes due to improper identifier escaping, specifies its impact, and notes that the issue is fixed in version 2.4.0.