Executive Summary

CVE-2026-56351 is a SQL injection vulnerability in n8n versions prior to 2.4.0 affecting MySQL, PostgreSQL, and Microsoft SQL nodes.

Authenticated users with workflow creation permissions can inject arbitrary SQL commands by supplying specially crafted table or column names in node configuration parameters.

This happens because the nodes fail to properly escape identifier values when constructing SQL queries, allowing attackers to execute unauthorized database commands.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized execution of SQL commands on the database used by n8n.

Attackers can compromise data integrity by injecting malicious SQL, potentially altering or corrupting data.

Because the vulnerability requires authenticated users with workflow creation permissions, it can be exploited by insiders or compromised accounts.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-56351 vulnerability, users should upgrade n8n to version 2.4.0 or later, where the issue has been patched.

As temporary mitigations, restrict workflow creation and modification permissions to trusted users only.

Additionally, disabling the affected MySQL, PostgreSQL, and Microsoft SQL nodes via environment variables can reduce risk, although this does not fully resolve the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users to execute unauthorized SQL commands, potentially compromising data integrity and confidentiality.

Such unauthorized access and manipulation of data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring data integrity.

Therefore, if exploited, this vulnerability could result in violations of these standards due to compromised data security controls.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects n8n versions prior to 2.4.0 in the MySQL, PostgreSQL, and Microsoft SQL nodes, allowing authenticated users with workflow creation permissions to inject arbitrary SQL through unescaped identifier values in node configuration parameters.

Detection involves verifying the version of n8n in use and checking for the presence of vulnerable nodes configured with unescaped or suspicious table or column names.

Since the vulnerability requires authenticated access with workflow creation permissions, monitoring for unusual workflow creation or modification activities and reviewing node configurations for suspicious SQL identifiers can help detect exploitation attempts.

No specific detection commands or network signatures are provided in the available resources.

Useful 0 Not Useful 0