CVE-2026-42229
Analyzed Analyzed - Analysis Complete
SQL Injection in n8n SeaTable Node

Publication date: 2026-05-04

Last updated on: 2026-05-06

Assigner: GitHub, Inc.

Description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows where external user input is passed via expressions into the SeaTable node's search or row retrieval parameters, an attacker could manipulate the constructed query to retrieve unintended rows from the connected SeaTable base, bypassing row-level filtering logic implemented in the workflow. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-04
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-05-05
EPSS Evaluated
2026-06-15
NVD
CVE-2026-42229
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.32 (exc)
n8n n8n 2.18.0
n8n n8n From 2.17.0 (inc) to 2.17.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the n8n workflow automation platform, specifically in the SeaTable node's row:search and row:get operations. Before certain fixed versions, user-controlled input was directly concatenated into SQL query strings without proper escaping or parameterization. This allowed an attacker to manipulate the SQL queries by injecting malicious input, potentially retrieving unintended rows from the connected SeaTable base and bypassing row-level filtering logic.

Impact Analysis

The vulnerability can allow an attacker to bypass row-level filtering in workflows using the SeaTable node, leading to unauthorized access to data rows that should be restricted. This could result in exposure of sensitive or confidential information stored in the SeaTable base, potentially compromising data integrity and confidentiality.

Mitigation Strategies

To mitigate this vulnerability, update the n8n platform to one of the patched versions: 1.123.32, 2.17.4, or 2.18.1.

Avoid passing external user input directly into the SeaTable node's row:search and row:get operations without proper escaping or parameterization.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42229. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart