Vulnerability Description
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| N8N | N8N | < 1.123.67 |
Related Weaknesses (CWE)
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-jqwr-vx3p-r266MitigationVendor Advisory
- https://www.vulncheck.com/advisories/n8n-before-sql-injection-via-postgrestriggeThird Party Advisory
FAQ
What is CVE-2026-72775?
CVE-2026-72775 is a vulnerability with a CVSS score of 8.8 (HIGH). n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names...
How severe is CVE-2026-72775?
CVE-2026-72775 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-72775?
Check the references section above for vendor advisories and patch information. Affected products include: N8N N8N.