Vulnerability Description
n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| N8N | N8N | < 2.4.0 |
Related Weaknesses (CWE)
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-f3f2-mcxc-pwjxMitigationVendor Advisory
- https://www.vulncheck.com/advisories/n8n-sql-injection-in-mysql-postgresql-and-mThird Party Advisory
FAQ
What is CVE-2026-56351?
CVE-2026-56351 is a vulnerability with a CVSS score of 8.2 (HIGH). n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier value...
How severe is CVE-2026-56351?
CVE-2026-56351 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56351?
Check the references section above for vendor advisories and patch information. Affected products include: N8N N8N.